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EXECUTIVE  SUMMARY 

Over  the  past  decade,  80  percent  of  all  Class  A  Naval  Aviation  (NA)  Flight 
Mishaps  (FMs)  can  be  attributed  to  human  error  (HE)  (Naval  Safety  Center,  1999).  In 
response,  the  Naval  Safety  Center  (NSC)  has  recently  adopted  the  Human  Factors 
Analysis  and  Classification  System  (HFACS)  model  and  is  studying  HE  more  thoroughly 
(OPNAV  3750.6R).  Previously,  the  NSC  studied  HE  primarily  by  classifying  it  in  a 
''who?  what?  and  why?"  format  (OPNAV  3750.6R).  This  classification,  not  developed 
under  any  specific  theoretical  framework  of  human  performance,  proved  difficult  to  infer 
any  specific  causes  of  HE  to  a  FM  (Shappel  &  Wiegmann,  1997).  The  recent 
introduction  of  the  theoretically  based  HFACS  by  the  NSC  (1997)  provides  a  sounder 
framework  for  the  study  of  HE  (Reason,  1990). 

The  occurrence  of  HE  has  been  studied  considerably  (Reason,  1990).  Naturally, 
psychologists  tend  to  study  HE  from  the  standpoint  of  their  own  psychological 
disciplines,  which  leads  to  conflicting  views  of  the  underlying  causes  of  HE  (Senders  & 
Moray,  1991).  Because  of  this  variance  in  the  different  theoretical  approaches  to  the 
study  of  HE,  the  U.S.  Navy  has  invested  a  great  deal  of  time  and  effort  in  the 
development  of  HFACS  for  the  classification  of  HE  in  Naval  Aviation  (Shappel  & 
Wiegmann,  1997).  The  basic  aim  in  the  study  of  accidents  involving  HE  should  be  to 
prevent  similar  accidents  from  reoccuring  by  anticipating  problems  in  similar  situations 
(Pimble  &  OToole,  1982). 

There  are  four  identified  layers  of  causation  in  the  HFACS  model: 

1)  Organizational  influences  composed  of  latent  failures, 

2)  Unsafe  supervision  composed  of  latent  failures, 

3)  Preconditions  for  unsafe  acts  composed  of  active  and  latent  failures, 

4)  Unsafe  acts  composed  of  active  failures  (OPNAV  3750.R). 

Active  failures  are  those  HEs  the  pilot  has  direct  control  over  at  the  time  of  the  FM  and 
latent  failures  are  causal  factors  which  the  pilot  has  no  direct  control  over  at  the  time  of 


the  FM.  The  four  layers  of  causation  are  composed  of  17  total  types  of  basic  HE  that 
define  the  HFACS  taxonomy. 

This  study  involves  the  analysis  of  an  existing  database  of  Class  A  and  B  flight 
mishaps  among  Naval  Aviation  Tactical  Aircraft  (TACAIR)  citing  HE  as  the  primary 
causal  factor  in  the  flight  mishap.  In  1998,  Naval  Aviation  Psychologists  at  the  NSC  took 
the  Class  A  FMs  from  fiscal  year  (FY)  90  to  FY98  and  classified  them  according  to  the 
HFACS  taxonomy.  The  Class  B  flight  mishaps  from  FY90  to  FY98  are  classified 
according  to  the  HFACS  taxonomy  by  the  author,  using  the  Mishap  Investigation  Reports 
(MIRs)  description  of  the  causal  factors  in  the  FM.  There  were  122  Class  A  TACAIR 
flight  mishaps  and  19  Class  B  TACAIR  flight  mishaps  from  FY90  to  FY97  categorized 
as  human  factors  flight  mishaps.  For  FY98,  there  were  12  Class  A  TACAIR  FMs  and  0 
Class  B  TACAIR  FMs  identified  as  human  factors  flight  mishaps. 

The  purpose  of  the  data  analysis  is  to  determine  any  important  relationships 
between  the  17  basic  types  of  human  error  in  the  HFACS  taxonomy  and  to  verify  that  the 
accident  arrival  rate  for  the  Class  A  and  B  TACAIR  human  error  flight  mishaps  is  from  a 
Poisson  distribution.  The  development  of  a  simulation  model  to  analyze  the  predicted 
future  occurrence  of  HE  types  in  the  HFACS  taxonomy  is  accomplished.  In  order  to 
explore  the  dataset  and  to  analyze  the  sets  of  flight  mishaps  associated  with  each  causal 
factor,  the  analysis  of  the  sets  consisted  of  studying  the  intersection  of  sets  between 
causal  factors.  The  most  important  relationships  are  found  in  multiple  set  intersections  of 
HFACS  HE  types.  It  is  here  that  "Adverse  Mental  State"  is  identified  as  an  important 
causal  factor.  Adverse  Mental  State  has  an  important  relationship  in  12  of  the  17  basic 
types  of  HE  in  the  HFACS  taxonomy.  When  one  of  these  12  HE  types  is  cited  in  an 
accident,  greater  than  70  percent  of  the  time,  the  investigation  also  cites  "Adverse  Mental 
State"  as  a  causal  factor. 

By  modeling  accident  and  flight  hours  for  FY90  to  FY97  in  a  log  linear  model,  the 
accident  arrival  rate  is  determined  to  be  Poisson.  The  significance  of  "Adverse  Mental 
State"  is  further  established  by  the  results  of  the  simulation.  The  only  important  multiple 
HE  types  in  the  simulation  were  those  paired  with  "Adverse  Mental  State."  Important  HE 


types  were  determined  to  be  significant  if  the  95  percent  confidence  interval  calculated 
from  the  simulation  run  did  not  contain  zero. 

Due  to  the  inherent  complexity  of  the  study  of  human  error,  making 
recommendations  for  its  reduction,  based  on  a  HE  type  that  shows  an  important 
relationship  with  multiple  HE  types,  is  the  best  approach.  Single  HE  type 
recommendations  do  not  take  into  account  the  interaction  that  causal  factors  undoubtedly 
have  in  a  flight  mishap.  Any  program  to  reduce  human  error  should  concentrate  on  an 
influential  HE  type  related  to  as  many  types  of  human  errors  as  possible.  This  program 
should  be  a  one-  to  two-hour  program,  requiring  aviators  to  attend  annual  or  semi-annual 
presentations  to  maintain  their  awareness  of  program  issues.  Given  the  strong 
relationships  between  "Adverse  Mental  State"  and  the  majority  of  the  other  HE  types  in 
the  HFACS  taxonomy,  establishing  a  human  error  flight  mishap  awareness  and  reduction 
program  based  on  "Adverse  Mental  State"  would  be  appropriate. 
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I.  INTRODUCTION 

Over  the  past  decade,  approximately  80  percent  of  all  Class  A  Naval  Aviation 
(NA)  Flight  Mishaps  (FMs)  have  been  attributed  to  human  error  (HE)  (Naval  Safety 
Center,  1999).  Although  mechanical  failure  is  an  important  causal  factor  in  FMs,  the 
accident  rate  for  mechanical  failure  is  decreasing.  Apparently,  HE  has  reached  a  plateau 
and  shows  no  signs  of  change  (Nutwell  &  Sherman,  1996).  Various  models  and 
taxonomies  have  been  used  to  study  HE  and  its  causes  (Shappell  &  Wiegmann,  1997). 
These  include  cognitive  information  processing  models,  models  of  cognitive  malfunction 
and  models  of  unsafe  acts.  These  models  are  essential  for  studying  HE  at  the  individual 
operator  level;  however,  the  study  of  HE  must  also  include  organizational,  supervisory 
and  environmental  influences  to  allow  the  human  factor  analyst  to  understand  such 
accidents  in  their  entirety  (Shappell  &  Wiegmann,  1997). 

As  previously  stated,  the  current  Class  A  FM  rate  in  NA  has  human  factor 
accident  rates  attributable  to  pilot  and  supervisory  error  as  high  as  80  percent.  This  rate  is 
of  great  concern  to  the  Navy  which  created  a  Human  Factors  Quality  Management  Board 
(HFQMB)  to  look  specifically  into  reducing  the  rate  of  human  factors  accidents  in  NA 
(Nutwell  &  Sherman,  1997).  The  majority  of  Naval  Aviation  human  error  FMs  occur  due 
to  the  direct  or  indirect  actions  of  pilots  and  their  supervisors.  Any  reduction  of  FMs  due 
to  HE  would  result  in  savings  in  both  lives  and  equipment. 

The  Naval  Safety  Center  (NSC)  has  recently  adopted  the  Human  Factors  Analysis 
and  Classification  System  (HFACS)  model  (OPNAV  3750. 6R)  to  meet  the  requirement 
to  study  HEs  more  thoroughly.  Previously,  the  NSC  studied  HE  primarily  by  classifying 
it  in  a  "who?  what?  and  why?"  format  (OPNAV  3750.6Q).  Because  this  classification 
was  not  developed  under  any  specific  theoretical  framework  of  human  performance,  it 
proved  extremely  difficult  to  infer  any  specific  causes  of  HE  (Shappel  &  Wiegmann, 
1997).    The  recent  introduction  of  the  theoretically  based  HFACS  by  the  NSC  (1997) 


provides  a  sounder  framework  for  the  study  of  HE  (Reason,  1990).  The  HFACS 
taxonomy  for  classifying  HE  allows  for  a  clear  representation  of  the  root  causal  factors  of 
HE  in  an  accident.  Once  these  factors  are  identified,  they  can  be  studied  in  a  cognitive 
psychological  context.  More  importantly,  potential  intervention  strategies  can  be 
evaluated  based  on  the  factors  identified.  The  future  impact  on  accident  frequency  and 
costs  can  be  assessed  using  intervention  strategies.  In  order  to  develop  specific 
intervention  strategies,  one  must  determine  if  any  of  the  identified  causal  factors  in  the 
FMs  are  important.  The  intent  of  this  thesis  is  to  identify  these  important  HEs  in  Naval 
Aviation  FMs  through  statistical  analysis  and  to  recommend  intervention  strategies. 

A.    BACKGROUND 

The  Naval  Safety  Center,  which  is  located  at  the  Norfolk  Naval  Air  Station, 
Virginia,  has  three  directorates:  aviation,  afloat  and  shore  safety,  and  five  support 
departments  (NSC,  1997).  The  directorates  work  both  independently  and  as  a  team  to 
help  the  Chief  of  Naval  Operation  and  the  Commandant  of  the  Marine  Corps  prevent 
operational  FMs,  promote  safety,  and  monitor  safety  programs.  Through  their 
involvement  in  all  phases  of  safety,  the  NSC  develops  recommendations  for  formulating 
safety  policies  to  maintain  the  highest  level  of  combat  readiness.  The  prevention  of  HE 
has  been  identified  as  one  of  the  biggest  remaining  challenges  for  NA  safety  (Nutwell  & 
Sherman,  1996).  With  a  thorough  study  of  the  HE  involved  in  Naval  Aviation  FMs, 
safety  policy  can  be  developed,  which  would  further  the  goals  of  the  NSC. 

The  NA  directorate  implements  the  Naval  Aviation  Safety  Program  (OPNAV 
3750.6Q)  supervised  by  the  Assistant  Chief  of  Naval  Operation  (Air  Warfare).  The  NA 
directorate  maintains  a  repository  for  all  reports  and  related  data  for  aircraft  FMs  and 
conducts  NA  statistical  research,  studies,  special  projects,  analyses  and  compilations  of 
aircraft  FMs  (NSC,  1997).  The  Naval  Aviation  Safety  Program  also  directly  or  indirectly 
assists  in  investigations  into  hazards  and  FMs.  Their  purpose  is  to  preserve  human  and 
material  resources  through  policies  that  prevent  similar  FMs  and  eliminating  known 
hazards.     NSC  personnel  also  conduct  safety  inspections  and  surveys  at  operational 


commands  to  evaluate  the  command's  safety  programs  and  practices  and  to  make 
recommendations  for  improvements. 

Previous  Naval  Postgraduate  School  (NPS)  theses  in  support  of  the  NSC  found  a 
relationship  between  human  factors  and  accident  causation  (Lacy,  1998;  Schmorrow, 
1998;  Sciretta,  1999;  Teeters,  1999).  These  theses  demonstrated  that  analyzing  human 
factors  is  a  highly  relevant  issue  to  reducing  all  Naval  Aviation  flight  mishaps.  Lacy 
(1998)  examined  major  mishaps  afloat,  Sciretta  (1999)  looked  at  electrical  mishaps 
afloat,  Schmorrow  (1998)  studied  reportable  NA  maintenance  related  mishaps  and 
Teeters  (1999)  contrasted  major  and  minor  maintenance  related  mishaps  with  one  Wing. 
The  common  thread  between  each  of  these  studies  is  the  conclusion  that  human  factors 
account  for  a  large  majority  of  Naval  mishaps  when  the  causal  factors  involved  in  the 
accidents  are  studied.  Each  author  successfully  modeled  arrival  rates  of  human  error 
accidents  and  subsequently  hypothesize  the  projected  monetary  savings  to  the  Navy  by 
varying  the  accident  arrival  rate  in  the  models. 

B.  OBJECTIVES 

The  primary  purpose  of  this  study  is  to  conduct  a  statistical  analysis  to  identify 
patterns  in  NA  Class  A  and  B  TACAIR  human  factor  flight  mishaps.  Moreover,  the 
author,  after  identifying  these  patterns,  will  determine  which  patterns  warrant  further 
analysis.  Then  through  a  simulation  model,  these  patterns  will  be  evaluated  for  statistical 
significance.  Finally,  the  author  will  identify  and  evaluate  effective  intervention 
strategies. 

C.  PROBLEM  STATEMENT 

Currently  a  formal  process  of  studying  HE  in  NA  has  not  been  fully  integrated 
into  the  investigation  of  flight  mishaps.  The  validation  of  the  HFACS  classification 
taxonomy,  through  statistical  analysis,  may  emphasize  the  importance  of  formally 
integrating  HFACS  into  the  accident  investigation  process.  By  studying  Class  A  and  B 
flight  mishap  Mishap  Investigation  Reports  (MIRs),  one  can  model  the  occurrence  of 


aircraft  FMs,  can  identify  potential  intervention  strategies  for  aircraft  FMs  due  to  HE.  and 
can  forecast  these  strategies  impact  on  future  FM  frequencies.  By  employing  current 
human  factors  theory,  including  the  classification  of  all  human  factors  FMs  studied  using 
the  HFACS  taxonomy,  and  by  applying  the  data  analysis  to  the  NA  Tactical  Aircraft 
(TACAIR)  FMs,  intervention  strategies  can  be  proposed.  This  would  save  both  lives  and 
valuable  resources  through  a  reduction  of  human  factors  flight  mishaps.  This  study 
investigates  the  following  questions: 

1)  Can  human  factor  trends  be  identified  using  the  HFACS  taxonomy  of  HE? 

2)  Can  potential  intervention  strategies  be  identified  for  the  primary  human 
factors  trends  found? 

3)  Can  the  intervention  strategies  identified  be  used  in  the  Class  A  and  B  FM 
models  to  evaluate  their  subsequent  impact  on  FM  frequency  and  costs? 

D.         DEFINITIONS 

This  study  uses  the  following  definitions  (OPNAVINST  3750.6Q,  1991): 

1)  Class  A  Mishap.  A  mishap  in  which  the  total  cost  of  property  damage 
(including  all  aircraft  damage)  is  $1,000,000  or  greater;  or  a  naval  aircraft  is  destroyed  or 
missing;  or  any  fatality  or  permanent  total  disability  occurs  with  direct  involvement  of 
naval  aircraft  (OPNAVINST  3750.6Q,  1991). 

2)  Class  B  Mishap.  A  mishap  in  which  the  total  cost  of  property  damage 
(including  all  aircraft  damage)  is  $200,000  or  more,  but  less  than  $1,000,000  and/or  a 
permanent  partial  disability,  and/or  the  hospitalization  of  five  or  more  personnel 
(OPNAVINST  3750.6Q,  1991). 

3)  Tactical  Aircraft  (TACAIR).  The  following  Naval  Aircraft  are  considered 
as  TACAIR  for  this  study:  A-4E,  A-4F,  A-4M,  A~4Q,  A-6A,  A-6B,  A-6E,  A-7B,  A-7C, 
A-7E,  A-7F,  AV-8B,  AV-8D,  EA-6A,  EA-6B.  EA-7L,  F-4A,  F-4G,  F-4J,  F-4N,  F-4S,  F- 
5E,  F-5F.  F-9F,  F-14A,  F-14B,  F-14C,  F-14D,  F-16N,  F-18A,  F-18B,  F-18C,  F-18D,  F- 
18E,  F-18F,  KA-6B,  KA6D,  OA-4M,  RF-18A  and  RF-4B. 


E.         SCOPE  AND  LIMITATIONS 

The  scope  of  this  study  encompasses  all  Naval  TACAIR  Class  A  and  B  FMs 
citing  human  factors  as  the  primary  causal  factor  of  the  FM  between  October  1,  1989,  and 
September  30,  1997.  It  examines  the  classification  of  HE  in  Naval  TACAIR  FMs,  using 
the  HFACS  taxonomy.  An  introduction  to  the  history  of  the  study  of  HE,  the  genesis  of 
the  NSC*s  HFACS,  and  the  use  of  human  factors  in  Naval  Aviation  accident  investigation 
is  discussed  in  Chapter  n.  Chapter  IQ  provides  a  framework  of  the  methodology  used  in 
the  study.  Chapter  TV  covers  a  data  analysis  of  the  HFACS  taxonomy,  a  modeling  of  the 
accident  arrival  rate,  and  a  modeling  of  the  rates  of  future  HE  occurrences,  as  defined  by 
the  HFACS  taxonomy.  Concluding  the  study,  Chapter  V  contains  a  research  summary, 
discussion  and  recommendations. 
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H.         LITERATURE  REVIEW 

There  has  been  considerable  study  into  the  occurrence  of  human  error  (HE)  in 
terms  of  why  we  make  mistakes  that  lead  to  accidents  (Reason,  1990).  Though  there  has 
been  much  interest  in  HE  by  many  researchers  and  authors,  there  is  a  lack  of  agreement  in 
the  field  of  HE  in  regard  to  a  proper  definition  of  error  (Senders  &  Moray,  1991).  This 
lack  of  agreement  is  an  issue,  which  makes  the  study  of  HE  difficult. 

Psychologists  tend  to  study  HE  from  the  vantage  point  of  their  psychological 
disciplines,  which  leads  to  different  views  of  the  underlying  causes  for  human  error 
(Senders  &  Moray,  1991).  These  differences  in  the  study  of  human  error  create 
alternative  theoretical  avenues  from  which  the  study  of  HE  is  approached.  Numerous 
industry  specific  taxonomies  are  applied  by  researchers  to  their  own  areas  of  interest. 
Most  of  these  taxonomies  are  based  on  the  concept  of  endogeneous  and  exogenous  causes 
of  HE,  those  that  have  their  origin,  inside  or  outside  the  person  (Senders  &  Moray,  1991). 
Even  with  the  commonality  of  endogeneous  and  exogenous  causes  of  HE,  taxonomies 
cannot  be  easily  transferred  from  one  area  of  study  to  another.  For  example,  taxonomies 
used  to  model  accidents  in  the  nuclear  energy  industry  are  difficult  to  transfer  to  the  study 
of  NA  accidents.  The  theoretical  underpinnings  of  these  different  taxonomies  often  do 
not  allow  them  to  be  compared  directly  with  other  taxonomies,  leading  to  slight 
theoretical  disagreements  regarding  the  various  models  of  HE  causation. 

Because  of  the  variance  in  the  different  theoretical  approaches  to  the  study  of  HE, 
the  U.S.  Navy  has  invested  a  great  deal  of  time  and  effort  in  the  development  of  a 
specialized  taxonomy  for  the  classification  of  HE  in  Naval  Aviation  (NA)  (Shappel  & 
Wiegmann,  1997).  In  pursuit  of  this  specialized  taxonomy  and  to  insure  consistency  of 
internal  studies  into  human  error,  the  Navy  has  decided  to  base  its  studies  of  HE  on  "The 
Taxonomy  of  Unsafe  Operation"  (Shappel  &  Wiegmann,  1997)  a  single  taxonomy  of  HE 
based  on  extensive  research  into  human  behavior  appropriate  to  the  Naval  Aviation 


community.    This  classification  system  is  currently  called  the  Human  Factors  Analysis 
and  Classification  System  (HFACS). 

A.         HUMAN  ERROR 

The  basic  aim  in  the  study  of  HE  accidents  should  be  to  prevent  similar  accidents 
from  occurring  again  and  anticipate  and  avert  hazardous  situations  (Pimble  &  O' Toole, 
1982).  For  an  empiric  study  of  human  error,  a  commonly  accepted  definition  of  HE  must 
exist.  This  has  been  one  of  the  issues  plaguing  the  study  of  human  error.  Few 
researchers  define  human  error  identically.  Some  authors  do  not  even  accept  a  definition 
for  human  error  (Senders  &  Moray,  1991).  Their  beliefs  are  grounded  in  Freudian 
psychology,  believing  that  there  are  no  accidental  errors-everything  is  either 
subconsciously  or  consciously  driven  (Senders  &  Moray,  1991).  However,  the  majority 
of  those  who  study  human  error  have  a  more  tangible  definition  of  HE.  They  do  not  view 
human  error  as  a  subconciously  driven  expression  of  the  individual,  but  simply  as  a 
mismatch  of  intention  and  action  (Senders  &  Moray,  1991). 

For  the  Freudian  camp,  the  explanation  of  human  error  would  follow  this  manner 
of  logic:  An  actor  in  a  given  scenario  is  supposed  to  lower  the  landing  gear  of  an  aircraft 
in-flight,  but  unintentionally  (at  least  consciously)  fails  to  do  so  and  lands  gear  up.  Since 
Freudian  theorists  do  not  accept  unintentional  causal  factors,  the  actor  must  have  willfully 
done  this  subconsciously  (Reason,  1990).  Why  would  the  actor  fail  to  perform  such  a 
vital  action  in  the  landing  sequence?  A  Freudian  explanation  would  proceed  as  follows: 
Internally,  the  actor  has  a  subconscious  conflict  between  the  inherent  risk  of  the  NA 
profession  and  a  long-term  commitment  to  his  or  her  family.  Consciously,  the  actor 
cannot  arbitrate  between  these  conflicting  issues.  As  a  result,  subconsciously,  the  actor 
decides  to  "quit"  flying  one  way  or  another.  The  next  day  while  he  is  landing,  the  actor's 
subconscious  intentionally  wills  the  conscious  to  forget  to  lower  the  landing  gear.  All 
this  occurs  because  the  actor  could  not  consciously  decide  to  quit  flying  even  though  in 
reality  his  or  her  preference  is  to  quit.    Fortunately,  the  majority  of  those  who  study  HE 


do  not  base  their  studies  on  Freudian  philosophy.  This  approach  to  the  study  of  human 
error  would  make  predicting  HE  extremely  complex,  if  not  impossible. 

Certainly,  although  the  majority  of  authors  do  not  agree  on  a  proper  definition  for 
human  error,  they  at  least  accept  the  existence  of  HE  (Senders  &  Moray,  1991). 
Generally  they  accept  a  broad-based  definition;  "When  one  interacts  with  machines  or 
complex  systems,  one  frequently  does  things  contrary  to  intention"  (Senders  &  Moray, 
1991).  Many  of  the  differences  between  researchers  occur  in  the  taxonomy  of  human 
error  which  they  use  in  their  study. 

Kollarits  (1937),  examining  approximately  1,200  human  errors  committed  by 
himself,  his  wife  and  his  colleagues,  conducted  one  of  the  earliest  studies  of  human  error. 
Proposing  an  initial  fourfold  classification  based  on  the  superficial  appearance  of  the  HE, 
Kollarits  used  a  taxonomy  of  substitution,  omission,  repetition  and  insertion.  Kollarits 
observed  that  sometimes  assigning  a  HE  unequivocally  to  a  single  category  was  difficult 
(Senders  &  Moray,  1991).  This  foreshadowed  the  classifying  of  HE  types  for  most  of  the 
mainstream  practitioners.  Unlike  the  Freudian  approach,  the  mainstream  approach  to  the 
study  of  human  error  breaks  the  causal  factors  of  HE  into  multiple  parts,  based  upon  the 
conscious  decisions  made  by  actors  in  the  decision-making  process. 

Breaking  this  human  error  into  its  atomic  parts  is  the  root  of  many  differences  in 
the  definition  of  human  error.  The  definition  of  a  human  error  certainly  depends  on  the 
point  of  view  of  the  person  judging  whether  a  HE  has  occurred  (Park,  1995;  Senders  & 
Moray,  1991).  The  individual  committing  the  human  error  recognizes  the  error  only  after 
it  has  occurred  thus,  the  individual's  perspective  is  only  hindsight.  Herein  lies  a  portion 
of  the  dilemma  of  defining  human  error.  What  if  the  HE  occurs  without  creating 
instability  in  the  system?  In  this  situation,  many  researchers  studying  human  error  would 
contend  that  no  HE  had  occurred  (Senders  &  Moray,  1991). 

Recalling  the  landing  gear  example  discussed  earlier,  reconsider  this  incident 
following  the  more  mainstream  ideals  of  human  error.  What  if  the  actor  decides  to  lower 
the  landing  gear,  reaches  for  the  landing  gear,  and  grabs  it,  but  then  the  aircraft's  airspeed 
enters  his  peripheral  vision.  This  cues  the  actor  to  focus  on  the  airspeed,  the  actor  notices 


that  the  airspeed  is  too  fast  to  lower  the  landing  gear  safely.  At  this  point,  the  actor  delays 
lowering  the  gear  until  the  aircraft  slows  to  the  correct  airspeed  to  lower  the  gear.  Has  a 
HE  been  made  in  this  circumstance?  Those  who  would  say  '"yes"  would  contend  that  a 
HE  had  occurred  because  the  actor  had  erred  simply  by  reaching  for  the  landing  gear. 
Those  researchers  who  would  argue  that  a  human  error  had  not  occurred  in  this  situation, 
approach  HE  from  a  less  rigid  viewpoint  (Senders  &  Moray,  1991).  They  would  say  that 
since  the  actor  recognized  this  incorrect  action  before  it  adversely  affected  the  system,  a 
human  error  had  not  occurred. 

For  a  thorough  in-depth  understanding,  the  best  study  of  human  error  would  be  to 
approach  the  study  of  HE  from  the  purists'  view  (AGARD,  1998).  At  a  minimum,  such  a 
study  would  require  each  aviator  to  maintain  a  human  error  diary  of  every  flight  (Lourens, 
1990).  This  study  also  could  not  be  short-term.  It  would  need  to  follow  aviators 
throughout  their  careers.  Obviously,  not  only  would  this  study  be  full  of  inaccuracies, 
due  to  self- reporting,  but  collecting  and  analyzing  all  this  data  would  be  highly  expensive. 
Moreover  the  aviators  would  likely  be  disinclined  to  report  their  faults  (AGARD,  1998). 
Such  a  study  would  most  likely  be  received  with  a  great  deal  of  distrust. 

Researchers  of  human  error  in  Naval  Aviation  must  therefore  rely  on  data 
gathered  on  reportable  incidents  of  HE  (AGARD,  1998),  i.e.  required  to  be  reported  by 
the  letter  of  the  law.  Consequentially,  they  take  the  theoretical  viewpoint  of  HE  as  having 
a  tangible  outcome,  affecting  the  correct  operation  of  the  system.  To  ensure  consistent 
results,  either  an  actor  or  an  external  analyst  needs  a  model  of  task  performance  in  order 
to  decide  whether  an  action  has  been  correctly  executed.  This  leads  to  HE  being  defined 
as  a  human  action  that  fails  to  meet  an  implicit  or  explicit  standard.  A  HE  occurs  when  a 
planned  series  of  actions  fail  to  achieve  a  desired  outcome  and  when  this  failure  cannot  be 
attributed  to  the  intervention  of  some  chance  occurrence  (Senders  &  Moray,  1991). 

In  aviation,  a  human  error  can  be  defined  as  an  action  or  event  with  an  effect  that 
is  outside  specific  tolerances  required  by  a  particular  system.  The  definition  does  not 
directly  refer  to  actions  of  the  pilot  but  only  to  the  consequences  of  the  pilot's  actions 
(Reason,  1990).   Even  if  the  actor  intended  to  do  '"A"  and  instead  did  "B,"  there  would 
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have  been  no  human  error  unless  the  system  had  exceeded  acceptable  limits  (Senders  & 
Moray,  1991).  Clearly,  if  an  accident  does  not  occur,  researchers  cannot  study  it.  In 
many  of  the  taxonomies  of  human  error,  the  researcher's  studies  start  here.  Their 
taxonomies  are  used  to  separate  these  accidents  into  specific  types  of  human  error  and  to 
study  them  to  provide  insight  into  preventing  future  HE  accidents. 

Human  error  can  be  seen  as  a  necessary  and  natural  part  of  skill  development 
(Lourens,  1990).  Human  error,  as  such,  is  always  part  of  control  operations  that  include 
feedback.  In  such  situations,  HEs  are  neither  good  nor  bad  (Wickens,  1991;  AGARD, 
1998).  When  human  errors  become  too  large,  badly  timed  or  hazardous,  they  become 
"grievous  human  errors."  A  "grievous  human  error"  occurs  when  the  actor  exceeds  safe 
operating  tolerances  (Senders  &  Moray,  1991).  In  order  to  advance  in  skill  and 
knowledge  people  must  commit  errors  to  advance  their  abilities.  Human  error  is  needed 
for  learning,  adaptating,  creating  and  surviving.  Human  error  may  result  in  a  destructive 
outcome,  but  there  may  be  virtue  in  these  HEs  if  they  result  in  learning  and  their  negative 
consequences  can  be  minimized.  Human  errors  are  the  inevitable  results  of  actors 
creatively  experimenting  with  their  environment  and  are  necessary  for  gaining  knowledge 
and  improving  one's  skills  (Neville,  1991). 

B.         TAXONOMIES 

If  HE  is  to  be  studied  empirically,  there  must  be  a  commonly  accepted  theory  of 
normal  behavior  (O'Hare,  Wiggins,  Batt  &  Morrison,  1994).  In  a  passage  from  the 
Principles  of  Psychology  (1890)  William  James  said,  "Habit  diminishes  the  conscious 
attention  with  which  our  acts  are  performed."  In  this  early  passage,  James  is  referring  to 
"schema,"  an  important  part  of  understanding  normal  behavior.  Schema  is  one  of  two 
important  processes  mentioned  by  Reason  as  important  when  developing  a  framework  so 
that  one  can  understand  human  cognition  (normal  behavior)  (Reason,  1990).  Reason 
mentions  two  control  modes  for  cognition:  attentional  and  schematic.  These  two  modes 
are  found  in  most  frameworks  that  outline  human  cognition  and  HE.  The  attentional 
mode  is  defined  as  conscious  processing  and  the  schema  mode  is  defined  as  automatic  or 
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unconscious  behavior  (Wickens,  Gordon  &  Liu,  1997).  Cognitive  activities  and  normal 
behavior  in  everyday  tasks  are  guided  by  a  complex  interplay  between  these  two  modes  of 
cognitive  control  (Reason,  1990). 

The  "attentional-control-mode"  is  related  to  working  memory  and  consciousness 
(Wickens,  1991).  This  mode  is  limited,  sequential,  slow,  effortful  and  difficult  to  sustain 
for  more  than  brief  periods  (Dosher  &  Sterling,  1986).  It  can  be  thought  of  as  the 
chalkboard  we  work  on  cognitively.  A  very  limited  amount  of  information  is  assimilated. 
This  process  is  controlled  in  a  conscious  and  largely  voluntary  manner.  Since  more  than 
one  high-level  activity  may  be  available  for  processing  at  any  one  time,  the  selection 
process  used  by  the  operator  becomes  very  important.  Much  of  the  attentional  mode's 
work  is  concerned  with  setting  future  goals,  with  selecting  the  means  to  achieving  them, 
with  monitoring  progress  toward  their  objectives,  and  with  the  detection  and  recovery  of 
HEs  (Reason,  1990). 

The  "schematic-control-mode"  is  not  consciously  brought  to  bear  on  activities 
(Wickens,  Gordon  &  Liu,  1997).  As  William  James  said,  "Habit  diminishes  our 
conscious  attention  to  a  task."  This  is  the  development  of  the  operator's  schema.  When 
people  intend  to  do  something,  they  think  about  their  intended  actions,  called  "planning 
ahead"  or  "forethought."  For  a  pilot  who  has  flown  a  particular  flight  profile  numerous 
times,  actions  become  automatic  (Bond,  Bryan,  Rigney  &  Warren,  1960).  The  schema 
developed  by  the  aviator  allows  an  increase  in  the  efficiency  with  which  the  aircraft  is 
flown.  This  allows  the  pilot  to  think  ahead  of  the  aircraft  because  he  or  she  does  not  have 
to  dwell  on  the  minutia  of  action  or  reaction  in  the  operation  of  the  aircraft. 

As  an  example,  the  actor  from  the  earlier  example  is  flying  and  decides  to  enter  a 
steep  angle  of  bank.  Early  in  an  aviator's  career,  this  can  be  a  difficult  manuever. 
requiring  the  complete  focus  of  the  attentional  control  mode  on  this  single  task  (Wickens, 
1991).  This  requires  the  actor  to  consciously  recite  a  rote  mnemonic  to  force  attention 
from  one  flight  instrument  to  the  next  to  execute  the  manuever  properly.  For  the  novice, 
this  manuever  uses  all  the  available  resources  of  the  attentional  control  mode.  For  the 
experienced  actor  such  a  manuever  is  barely  noticed  consciously,  except  for  setting  the 
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parameters  correctly  for  the  entry  into  the  manuever  (Hart  &  Sheridan,  1984).  This 
manuever  requires  very  little  use  of  the  actor's  attentional  control  mode,  which  is  a 
limited  resource,  allowing  these  resources  to  be  focused  on  planning  issues  instead  of 
basic  manuevers.  For  the  expert,  an  organized  unit  of  knowledge,  the  schema,  is 
activated  to  accomplish  the  manuever  (Reason,  1990).  Many  of  the  taxonomies  on  HE  in 
some  way  incorporate  these  ideas  of  attentional  control  and  a  schematic  control  mode. 

A  number  of  models  have  brought  insight  and  value  to  the  study  of  HE  (Senders 
&  Moray,  1991).  James  Reason  provides  a  compilation  of  some  of  the  most  influential 
taxonomies  in  the  study  of  human  error  (Reason,  1990).  The  Norman-Shallice  model 
represents  a  family  of  action  theories.  Rasmussen's  "skill-rule-knowledge"  framework 
models  cognitive  control  processes.  Rouse's  "fuzzy  rule"  model  is  based  on  the 
assumption  that  humans  are  not  truly  optimizers  in  their  thought  processes.  Baar's  global 
workspace  (GW)  model  focuses  on  interaction  within  working  memory.  Reason's 
generic  HE  modeling  system  (GEMS)  builds  its  structure  around  Rasmussen's  ideas  of 
skill-based  slips  and  lapses,  rule-based  mistakes,  and  knowledge-based  mistakes  for  HE 
classification  (Park,  1994).  The  Helmreich  model  attempts  to  go  further  in  the  study  of 
HE  by  focusing  outside  of  operator  human  error.  Four  concentric  circles  represent 
Helmreich' s  model  with  operator  error  at  the  innermost  circle,  which  is  influenced  by 
external  factors  in  the  outer  circles.  Each  of  these  taxonomies  has  had  an  impact  on  the 
way  human  error  is  viewed  in  the  particular  industrial  applications  for  which  the 
taxonomy  was  developed.  The  study  of  HE  in  Naval  Aviation  draws  a  little  from  each 
but  focuses  mainly  on  the  studies  by  Rasmussen  and  Reason  for  the  development  of  an 
aviation  specific  taxonomy.  The  NSC's  Human  Factors  Analysis  and  Classification 
System  (HFACS)  uses  theoretical  constructs  from  both  Reason  and  Rasmussen  in 
modeling  human  error. 

1.         Norman-Shallice's  Attention  to  Action  Model 

Norman  and  Shallice  developed  an  attention  to  action  model,  which  provides  for 
two  kinds  of  control  structures,  horizontal  threads  and  vertical  threads  (Norman  & 
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Shallice,  1990).  The  model  is  based  upon  the  idea  that  an  adequate  theory  of  human 
action  must  account  for  not  only  correct  performance,  but  also  for  the  more  predictable 
varieties  of  human  error.  Systematic  HE  form  and  correct  performance  are  seen  as  two 
sides  of  the  same  theoretical  coin  (Reason,  1990). 

The  control  system  proposed  by  Norman  and  Shallice  is  clearly  related  to  the 
attentional-  and  schema-control-mode  view  of  human  error  (Norman  &  Shallice.  1990). 
The  horizontal  threads  are  each  composed  of  a  self- sufficient  strand  of  specialized 
processing  structures  (schema).  The  vertical  threads  interact  with  the  horizontal  threads 
giving  the  means  by  which  attentional  or  motivational  factors  can  change  the  schema 
activation  values.  Horizontal  threads  govern  habitual  activities  not  requiring  the  need  to 
receive  constant  attentional  control,  triggered  by  environmental  input  or  previously  active 
schemas.  Higher  level  attentional  processes  come  into  play  through  the  vertical  threads, 
in  unique  or  critical  situations  when  currently  active  schemas  are  insufficient  to  achieve 
the  current  goal.  This  adds  to  or  decreases  schema  activation  levels  to  modify  ongoing 
behavior.  Norman  and  Shallice  also  include  motivational  variables  which  they  view  as 
influencing  schema  activation  along  the  vertical  threads,  but  motivational  variables  are 
assumed  to  work  over  much  longer  time  periods  than  the  attentional  resources  (Reason, 
1990). 

An  example  of  the  interaction  between  vertical  and  horizontal  threads  could  be  the 
previously  discussed  experienced  actor  flying  into  the  airport  traffic  pattern.  As  the  actor 
enters  the  landing  pattern,  active  horizontal  threads  (schemas)  allow  the  actor  to  control 
many  variables  without  continuously  monitoring  them.  Without  warning,  the  actor 
notices  flocks  of  birds  in  the  aircraft's  flight  path.  In  this  critical  situation,  a  vertical 
thread  (attentional-control-mode)  activates  an  evasive  manuever  schema  contained  in  a 
horizontal  thread.  This  allows  the  actor  to  execute  quickly  a  series  of  control 
manipulations,  without  having  to  use  his  or  her  attentional-control-mode,  to  avoid  the 
hazard. 
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2.  Rasmussen's  Skill,  Rule  and  Knowledge  System 

Like  Norman  and  Shallice's,  Rasmussen's  (1982)  "skill-rule-knowledge"  model 
of  cognitive  control  mechanisms  is  also  human  error  oriented.  Rasmussen  was  more 
interested  in  studying  fatal  human  errors  specifically.  The  framework  of  the  model  is 
based  on  the  study  of  those  in  supervisory  control  of  industrial  installations,  particularly 
during  emergencies  in  hazardous  process  plants.  The  highly  familiar,  "skill-rule- 
knowledge"  framework  originated  from  a  verbal  protocol  study  of  technicians  engaged  in 
electronic  trouble  shooting  in  a  study  by  Rasmussen  and  Jensen  in  1974. 

Three  levels  of  performance  correspond  to  decreasing  levels  of  familiarity  with 
the  environment  or  task  (Reason,  1990).  Skill-based  performance  is  governed  by  stored 
patterns  of  behavior  also  known  as  schema  (Park,  1994).  The  skill-based  levels  of  action 
are  vulnerable  to  failures  of  attention  and  memory.  Rule-based  performance  is  applicable 
to  tackling  familiar  problems  in  which  solutions  are  governed  by  stored  rules  of  the  type: 

if  (state)  then  (diagnosis)  or  if  (state)  then  (remedial  action) 

(Wickens,  Gordon  &  Liu,  1997).  Rule-based  performance  is  also  comparable  to  Norman 
&  Shallice's  interaction  between  vertical  and  horizontal  threads,  where  the  attentional- 
control-mode  is  used  in  identifying  the  problem  to  be  solved  and  stimulating  specific 
problem-solving  schemas.  An  example  of  this  would  be  a  pilot's  reaction  to  an  in-flight 
emergency.  The  pilot  uses  attentional  resources  in  identifying  the  perceived  emergency 
and  responds  with  a  practiced  response,  schema,  to  the  identified  emergency. 

Human  errors  at  the  rule-based  level  are  typically  associated  with  the 
misclassification  of  situations  leading  to  the  application  of  the  wrong  rule  or  the  incorrect 
recall  of  procedures  (Reason,  1990).  Knowledge-based  issues  of  HE  come  into  play  in 
novel  situations  for  which  actions  must  be  planned  on-line,  using  conscious  analysis 
(attentional-control-mode)  and  stored  knowledge  (Wickens,  Gordon  &  Liu,  1997). 
Human  errorss  at  this  level  arise  from  resource  limitation  and  incomplete  or  incorrect 
knowledge.     With  increasing  expertise,  the  primary  focus  of  control  moves  from 
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knowledge-based  toward  the  skill-based  levels  but  all  three  levels  can  co-exist 
simultaneously  (Reason,  1990). 

According  to  Reason,  Rasmussen's  major  contribution  in  his  model  for  the  theory 
of  HE  in  cognitive  processes  is  how  he  theorizes  the  interaction  of  the  operator's 
cognition  and  the  levels  of  human  error  (Reason,  1990).  Rasmussen  charted  the  shortcuts 
that  human  decisionmakers  take  in  real-life  situations,  known  as  the  "Step-Ladder"  model 
(Park,  1994).  Instead  of  a  linear  relationship  in  decision-making  as  most  decision 
theorists  had  represented,  Rasmussen's  model  is  analogous  to  a  stepladder,  with  the  skill- 
based  activation  and  execution  stages  at  the  bases  on  either  side  and  the  knowledge-based 
interpretation  and  evaluation  stages  at  the  top.  Intermediates  on  either  side  are  the  rule- 
based  stages  (Reason,  1990).  Shortcuts  may  be  taken  between  these  various  stages, 
usually  in  the  form  of  highly  efficient  but  situation  specific  stereotypical  reactions. 
Where  the  observation  of  the  system's  state  leads  automatically  to  the  selection  of 
remedial  procedures,  without  the  slow  and  laborious  intervention  of  knowledge-based 
processing.  This  stepladder  layout  also  allows  for  associative  leaps  between  any  of  the 
decision  stages.  This  strategy  can  also  increase  a  person's  vulnerability  to  making  HEs 
because  the  strategy  is  overly  reliant  on  the  appropriateness  of  past  experience  (Park, 
1994). 

Using,  again,  the  previous  actor  as  an  example,  human  error  can  be  looked  at  in 
terms  of  "skill,  rule  and  knowledge"  based  cognitive  processes.  Skill-based  errors  will 
occur  when  the  actor  is  in  a  familiar  environment.  As  an  example,  the  actor  is  taxiing  an 
aircraft  at  his  or  her  homebase  (very  familiar  surroundings  and  routines).  New 
construction,  however,  has  rerouted  the  actor's  familiar  patterns  of  returning  to  his 
squadron.  After  landing,  the  pilot  turns  onto  the  closed  taxiway  and  damages  the 
aircraft's  engine,  due  to  debris  on  the  closed  taxiway. 
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Rule-based  errors  will  occur  when  the  aviator  does  not  have  a  lot  of  experience  in 
a  variety  of  unique  and  common  situations.  Experienced  aviator's  avoid  rule-based  errors 
because  of  his  or  her  exposure  to  multiple  experiences.  Rule-based  human  errors  are 
going  to  occur  in  the  form: 

if  (state)  then  (diagnosis)  or  if  (state)  then  (remedial  action) 

types  of  rule-based  behavior.  Knowledge-based  errors  occur  when  the  aviator  decides  to 
execute  a  plan  and  the  plan  turns  out  to  be  inappropriate  for  the  situation.  An  example  is  a 
poor  approach  choice  in  bad  weather.  Once  the  actor  commits  himself  to  the  approach 
and  enters  the  weather,  his  skills  may  be  exceeded  and  a  human  error  flight  mishap  (FM) 
could  ensue. 

3.  Rouse's  "Fuzzy  Rule"  Model 

Rouse  (1981)  in  developing  his  "fuzzy  rule"  model  attempted  to  bring  computer 
based  modeling  of  HE  to  bear  on  the  problem  of  prediction.  Rouse  uses  rules  based  upon 
concepts  of  artificial  intelligence.  The  model  attempts  to  model  human  cognition  by 
trying  to  codify  the  way  human  memory  encodes  stores  and  retrieves  a  limitless  set  of 
schematic  representations.  Assuming  that  knowledge  is  based  on  a  rule-based  format,  a 
necessary  assumption  for  modeling  an  artificial  intelligence  system,  Rouse  distinguished 
two  types  of  problem-solving  rules:  symptomatic  strategy  (S-rules)  and  topographic 
search  (T-rules)  (Reason,  1990).  For  Rouse's  decisionmakers,  they  can  either  use  an  S- 
rule  or  T-rule  to  solve  a  problem.  For  the  S-rule,  identification  of  the  problem  is  derived 
from  a  match  between  local  system  cues  and  a  stored  representation  of  a  pattern  of 
indications  of  a  failure  state  in  the  system.  In  keeping  with  the  flavor  of  the  artificial 
intelligence  approach  Rouse  brings  to  the  model,  S-rules  are  frequently  used  in  a  rule- 
based  form  with  some  appropriate  remedial  diagnoses. 
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As  an  example  of  an  S-rule,  using  the  aviating  actor  from  the  previous  example: 

if  (the  landing  gear  handle  is  down  and  all  the  lights  are  not  illuminated 
for  gear  down  indications),  then  (check  the  hydraulic  pressure  gauges). 

The  T-rules  need  not  contain  any  reference  to  specific  system  components  but  instead 
require  access  to  a  mental  or  actual  map  of  the  system.  T-rules  also  require  consideration 
of  the  structural  and  functional  relationships  between  their  constituent  parts.  An  example 
of  the  T-rule  is  based  more  on  a  predicate  calculus  approach  to  the  problem  at  hand: 

if  (the  functioning  ofX  is  faulty  and  X  depends  on  Y  and  Z,  and  Y  is  known 
to  be  working),  then  (check  Z). 

The  use  of  S-rules  and  T-rules  as  the  theoretical  underpinning  of  his  model  allows  for 
easy  access  to  programming  in  artificial  intelligence.  A  list  of  Rouse's  rules  could  easily 
be  transferred  to  computer  languages,  such  as  LISP  or  PROLOG,  and  then  used  to  model 
human  behavior  and  from  there  if  statistically  significant,  to  predict  HE  in  various 
situations. 

4.  Baar's  Global  Workspace  (GW)  Model 

Baar's  (1988)  construction  of  his  global  workspace  model  is  another  that  parallels 
the  schema  and  attentional-control-mode  research.  Baar  explains  the  multiple  pairs  of 
apparently  similar  phenomena  that  seem  to  differ  in  the  fact  that  one  is  conscious 
(attentional)  and  the  other  is  not  (schema).  Baar  concentrates  on  what  is  termed  the 
"global  workspace,"  a  working  memory  that  allows  for  interaction  of  specialist  processors 
(Reason,  1990).  These  processors  compete  for  access  to  the  global  workspace  based  on 
their  current  activation  level.  The  operators'  consciousness  reflects  the  current  contents 
of  the  global  workspace.  Baar's  global  workspace  model  is  closely  identified  with  short- 
term  memory  and  the  limited  capacity  components  of  the  cognitive  system,  concentrating 
more  on  the  attentional  control  mode  discussed  earlier  and  how  it  interacts  with  the 
schema. 
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Baar's  Global  Workspace  model  does  not  extend  as  far  as  the  others  but  looks 
primarily  at  the  attentional-control-modes  and  their  interactions.  Working  memory  is 
limited  and  the  actor  can  only  maintain  a  limited  amount  of  information  in  Baar's  GW 
model.  Let  us  take  an  example  from  our  previous  actor  and  look  at  it  in  terms  of  the  GW, 
through  which  only  a  limited  amount  of  information  can  be  actively  processed.  If  the 
actor  is  being  given  specific  unfamiliar  instructions  while  in  flight,  the  majority  of  the 
total  workspace  available  in  the  GW  is  used.  If  an  event  with  a  higher  priority  comes  to 
the  attention  of  the  GW,  such  as  a  warning  light,  the  warning  light  has  a  higher  activation 
level  than  anything  currently  in  the  global  workspace.  This  higher  activation  level 
displaces  the  currently  active  items  in  the  global  workspace  and  allows  the  GW  to  give 
full  attention  to  the  warning  light. 

5.  Generic  Error  Modeling  System  (GEMS) 

The  Generic  Error  Modeling  System  (GEMS)  by  Reason  (1990)  is  another  rule- 
based  type  model  using  the  ideas  of  attentional-control-modes  and  schema.  Reason 
borrows  heavily  from  Rasmussen's  "skill-rule-knowledge"  model  but  additionally 
attempts  to  locate  the  possible  origins  of  these  basic  HE  types.  The  GEMS  model 
addresses  cognitive  human  error.  By  addressing  the  cognitive  factors  instead  of 
environmental  or  context-related  factors,  one  can  expect  that  the  human  error 
classification  in  GEMS  will  be  applied  to  the  analysis  of  HE  in  a  variety  of  industrial 
situations  (Park,  1994). 

Reason  distinguishes  between  three  separate  performance  levels  for  the  model, 
skill-based,  rule-based  and  knowledge-based  levels.  Skill-based  performance  is  based  on 
sensorimotor  performance,  taking  place  without  conscious  control.  Rule-based  and 
knowledge-based  performance  come  into  play  only  after  one  becomes  consciously  aware 
of  a  problem.  In  this  sense,  skill-based  errors  generally  precede  the  detection  of  a 
problem  and  rule-  and  knowledge-based  errors  arise  during  subsequent  attempts  to  find  a 
solution.  In  regards  to  control  modes,  skill-  and  rule-based  levels  of  performance  are 
related  to  schematic  modes  of  control,  and  knowledge-based  levels  of  performance  are 
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related  to  attentional-control-modes.  The  GEMS  model  attempts  to  present  an  integrated 
picture  of  the  HE  mechanism  operating  at  all  three  levels  of  performance.  A  main 
assertion  of  GEMS  is  that  when  confronted  with  a  problem,  people  are  biased  strongly  to 
search  for  a  familiar  schema.  This  occurs  at  the  rule-based  level,  before  one  attempts  to 
solve  the  problem  at  the  more  demanding  attentional  knowledge-based  level.  This  is  true, 
even  if  the  individual  attempted  to  solve  the  problem  at  the  knowledge-based  level  to  start 
with  (Reason,  1990). 

The  GEMS  model  parallels  closely  the  example  of  Rasmussen's  (1982)  "skill, 
rule,  knowledge"  based  HE  taxonomy.  The  difference  is  that  Reason  (1990)  hypothesizes 
that  an  actor  presented  with  a  problem  first  attempts  to  solve  the  problem  at  the  less 
attentionally  demanding  schema  level.  The  actor  in  this  situation  attempts  to  use  a 
familiar  schema  that  has  worked  in  the  past  to  solve  a  similar  problem.  As  an  example, 
suppose  that  during  aerial  combat,  the  actor  consistently  relies  on  an  effective  high  "g" 
manuever  to  disengage  from  an  opponent.  Then  in  the  future  if  the  actor  finds  himself  in 
a  position  requiring  a  manuever  of  last  resort  to  disengage  from  his  opponent,  he  relies  on 
the  high  "g"  manuever  prior  to  attempting  anything  else  required  to  disengage  from  the 
aerial  combat. 

6.         The  Helmreich  Model 

The  Helmreich  Model  approaches  accident  investigation  into  HE  as  a  grouping  of 
separate  environments  (Zotov  &  Dmitri,  1996).  The  intent  of  the  model  is  to  be  a  crew- 
centered  study  to  accident  causation  and  external  factors  are  studied  for  their  influence  on 
the  crew  involved  in  the  flight  mishap.  These  separate  environments  are  grouped  into 
concentric  circles,  each  affecting  those  they  encircle.  The  theory  of  the  model  is  that  in 
reality  the  interaction  and  entanglement  of  multiple  factors  result  in  an  accident  (Zotov  & 
Dmitri,  1996). 

The  innermost  circle,  the  crew  environment,  concerns  issues  regarding  the  crew's 
interaction,  communication,  personalities  and  Crew  Resource  Management. 
Encompassing  this  circle  is  the  physical  environment  in  which  the  crew  operates,  issues. 
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such  as  aircraft  idiosyncrasies,  defects  and  performance  characteristics,  the  weather,  both 
local  and  general,  and  the  airport  environment.  Outside  of  these  factors  is  the 
organization  that  purchases  and  maintains  the  aircraft,  trains  the  crews,  and  is  supposed  to 
support  their  actions.  Surrounding  these  concentric  circles  is  a  regulatory  environment  in 
which  regulatory  action  should  ensure  safe  standards  of  operation  (Zotov  &  Dmitri, 
1996).  The  Helmreich  Model  views  the  breakdown  of  human  error  in  accidents  as  a  web 
of  entangled  strands  of  HE,  attaching  causal  factors  at  different  points  within  the 
concentric  circles.  Frequently  researchers  debate  whether  an  accident  is  the  result  of  a 
chain  of  events.  The  Helmreich  Model  theorizes  that  the  accumulation  of  factors,  rather 
than  a  single  linkage  of  chained  events  can  cause  an  flight  mishap.  Accidents,  seldom 
occuring  in  isolation,  are  more  likely  to  happen  as  a  complex  web  of  events,  culminating 
in  the  accident  (Zotov  &  Dmitri,  1996). 

Looking  at  the  previous  examples,  all  the  models  have  been  centered  on  the  actors 
and  their  actions  or  inaction.  Helmreich  brings  into  focus  outside  influences  on  the  actor 
that  influence  what  occurred  in  the  flight  mishap.  As  an  example,  consider  an  aviator 
involved  in  an  FM  where  fatigue  is  the  main  causal  factor  cited  in  the  flight  mishap.  To 
understand  fully  the  main  causal  factor  of  the  FM,  the  investigator  must  look  outside  of 
the  aviator  to  the  environment  that  effects  him  or  her.  Other  factors  just  as  important  to 
the  FM  are:  poor  diet,  weather,  lack  of  proper  supervision  or  proper  leadership  in  the 
organization.  All  these  items  may  play  an  integral  role  in  the  FM,  in  addition  to  the 
aviator's  direct  role  in  the  flight  mishap. 

C.         HUMAN  FACTORS  ANALYSIS  AND  CLASSIFICATION  SYSTEM 

The  Naval  Safety  Center's  "HFACS"  is  a  taxonomy  developed  specifically  for 
NA  (Shappel  &  Wiegmann,  1997).  Influencing  the  HFACS  taxonomy  are  many  of  the 
taxonomies  discussed  above.  HFACS  uses  the  theoretical  basis  for  HE  described  by  both 
Rasmussen  and  Reason  in  terms  of  skill-based,  rule-based  and  knowledge-based  levels  of 
performance.  As  in  Helmreich' s  model,  HFACS  theorizes  that  accidents  do  not  occur  in 
isolation  but  are  often  the  result  of  both  internal  and  external  influences  like  supervisory 
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and  organizational  HE  contributing  to  the  accident.  This  taxonomy  also  incorporates  the 
"Domino  Theory,"  introduced  by  Heinrich  (1980).  Heinrich's  theory  proposed  that 
accident  causation  is  not  singular  but  has  many  links  in  a  chain  to  a  tragic  human  error. 
Anywhere  in  this  line  of  dominoes,  someone  could  remove  a  causal  domino  to  prevent 
that  final,  fatal  domino  from  falling  (Shappel  &  Wiegmann,  1997).  Of  course,  as 
discussed  by  Helmreich,  the  solution  may  not  be  as  simple  as  removing  a  single  domino 
in  the  accident  sequence  to  avert  a  flight  mishap.  Although  the  domino  may  be  attached 
in  the  line  of  accident  causation,  a  strand  in  the  web  of  causation  could  bypass  this 
particular  domino,  and  even  though  the  domino  is  removed  a  continuity  in  the  chain  of 
events  may  still  exist.  In  a  human-factors-accident,  research  shows  that  complexity  is  the 
norm  (Zotov  &  Dmitri,  1996). 

There  are  four  identified  layers  of  causation  in  the  HFACS  model: 

1 )  Organizational  influences  composed  of  latent  failures, 

2)  Unsafe  supervision  composed  of  latent  failures, 

3)  Preconditions  for  unsafe  acts  composed  of  active  and  latent  failures, 

4)  Unsafe  acts  composed  of  active  failures  (OPNAV  3750.6R). 

Active  failures  are  those  HEs  the  pilot  has  direct  control  over  at  the  time  the  FM  occurrs, 
and  latent  failures  are  those  causal  factors  the  pilot  has  no  direct  control  over  at  the  time 
the  FM  occurrs.  The  HFACS  taxonomy  is  illustrated  by  the  "Swiss  Cheese"  model  of  HE 
causation,  adapted  from  ideas  of  James  Reason.  The  illustration  is  composed  of  four 
integrated  overlapping  layers  that  affect  the  final  HE,  which  results  in  an  accident  (Figure 
1).  The  main  point  of  HFACS  is  that  HE  is  not  studied  as  it  is  in  the  GEMS  model.  The 
GEMS  model  studies  the  operator  level  alone,  but  HFACS  instead  looks  upward,  as  in 
the  Helmreich  Model,  realizing  that  there  may  be  multiple  contributing  factors  to  unsafe 
acts  performed  by  the  operator. 
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Figure  1.  The  "Swiss  Cheese"  Model  of  HE  Causation  (adapted  from  Reason,  1990). 


Each  of  the  overlapping  layers  as  seen  in  Figure  1  is  also  composed  of  multiple 
underlying  causal  factors  of  human  error.  These  underlying  causal  factors  allow  HE  to  be 
more  specifically  categorized.  The  structure  of  this  taxonomy  can  be  seen  in  Chapter  HI, 
Figure  2.  The  lowest  categories  in  this  taxonomy  give  a  thorough  breakdown  of  the 
majority  of  the  prime  contributors  to  a  human  error  flight  mishap. 

Part  of  the  difficulty  in  analyzing  and  studying  HE  is  developing  a  theory  of 
human  behavior  and  modeling  it  to  human  error  (Park,  1994;  Wickens,  1990;  Senders  & 
Moray,  1991).  Analyzing  and  studying  HE  requires  the  development  of  a  taxonomy 
using  a  solid  theory  of  human  performance.  As  described  in  the  preceding  sections,  there 
are  many  taxonomies,  developed  by  a  diverse  group  of  respected  individuals,  that 
describe  HE  in  relation  to  human  behavior.  So  where  does  the  study  of  human  error 
begin  with  so  many  HE  taxonomies  in  the  literature?  To  revamp  or  develop  anew?  is  the 
question  posed  by  Shappel  and  Wiegmann  (1997).  Researching  the  taxonomies  from  the 
viewpoint  of  the  industry  to  be  studied  is  the  key.    The  answer  for  the  U.S.  Navy  of 
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course  is  developing  HFACS  through  a  combination  of  the  most  relevant  theories  of  HE 
to  Naval  Aviation. 

D.         SUMMARY 

In  spite  of  the  academic  differences  in  the  study  of  human  behavior,  currently  the 
mainstream  view  is  to  study  behavior  using  the  ideas  of  attentional  and  schematic  control 
modes.  The  study  of  human  behavior  is  essential  in  the  development  of  taxonomy  to 
study  human  error.  From  the  understanding  of  behavior,  taxonomies  can  be  developed  to 
chart  the  path  and  causes  of  HE  in  the  operation  of  complex  systems.  Taxonomies  of 
human  error  are  a  fundamental  requirement  to  build  a  scientific  foundation  for  the  study 
of  HE,  and  its  causes  (Hill,  Byers,  Rothblum  &  Booth,  1994).  Such  studies  facilitate  a 
more  complete  understanding  of  the  nature,  origin  and  causes  of  HE,  all  necessary  for  a 
clear  classification  scheme  for  describing  human  error.  A  taxonomies  breakdown  of  the 
components  of  HE  allows  for  the  empirical  study  of  human  error. 

The  need  for  a  taxonomy  with  which  to  study  Naval  Aviation  HEs  is  the  impetus 
for  the  development  of  HFACS.  As  stated  by  Shappel  and  Wiegmann  (1997): 

Once  a  comprehensive  model  is  identified,  a  relational  database  needs  to 
be  constructed  to  assess  the  interrelations  among  error  types.  A  relational 
database  would  facilitate  the  testing  of  theories  about  the  strength  of  the 
relation  between  latent  factors  and  the  occurrence  of  specific  errors 
committed  by  operators.  Similarly,  a  relational  database  would  allow  for  a 
more  refined  analysis  of  the  effects  that  one  type  of  operator  error  (e.g., 
judgment  error)  has  on  the  occurrence  of  another  (e.g.,  procedural  error). 
In  essence,  once  a  unifying  framework  is  identified,  the  causal  chain  of 
events  leading  to  an  accident  can  be  more  easily  inferred,  intervention 
strategies  more  readily  identified,  and  the  tragic  chain  of  events  ultimately 
broken,  (p.  79) 

The  most  appropriate  solution  is  to  develop  anew.  The  method  currently  used  by  the  U.S. 
Navy  to  investigate  and  classify  HE  is  a  scheme  that  is  loosely  tied  to  a  "who?  what?  and 
why?"  format  (Shappel  &  Wiegmann,  1997).  This  format  does  not  allow  for  the 
structured  study  of  HE  causation.     To  increase  the  effectiveness  of  combating  HE, 
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HFACS  was  conceived,  borrowing  from  some  of  the  most  well  developed  theories  of 
human  behavior  and  taxonomies  of  human  error.  HFACS  was  developed  for  the  U.S. 
Naval  Aviation  community  to  classify  and  to  assist  in  the  reduction  and  prevention  of 
human  error.  HFACS  is  the  comprehensive  model  of  HE  and  a  natural  relational 
database  from  which  to  study  human  error.  Shappel  and  Wiegmann  envisioned  HFACS 
would  assist  in  the  reduction  of  Naval  Aviation  FMs  due  to  human  error.  HFACS 
provides  a  relational  database  of  HE  for  analysts  to  study  using  statistical  tools,  and 
HFACS  serves  as  an  excellent  collection  device  for  consistent  data  reporting  of  flight 
mishaps.  For  the  Naval  Aviation  community,  the  more  structured  and  empirical  study  of 
HE  through  HFACS  offers  insight  into  the  causes  of  accidents  due  to  human  error.  This 
empirically  based  study  of  HE  will  lead  to  active  policies  that  reduce  the  occurrence  of 
Naval  Aviation  human  errors. 
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III.   METHODOLOGY 

The  ultimate  goal  in  this  thesis  is  to  identify  human  errors  (HE)  common  to  many 
FMs,  to  increase  pilot  awareness  of  these  identified  HE  types,  and  eventually  to  reduce 
the  overall  number  of  flight  mishaps  (FMs)  citing  these  HE  types.  This  study  uses  an 
existing  database  of  Class  A  and  B  Tactical  Aircraft  (TACAIR)  Mishap  Investigation 
Reports  (MIR)  maintained  by  the  Naval  Safety  Center  (NSC).  The  MIRs  selected  are 
FMs  citing  HE  as  the  primary  causal  factor  of  the  accident.  An  analysis  of  the  HE  types 
in  the  data  is  conducted  using  the  Human  Factors  Analysis  and  Classification  System 
(HFACS)  taxonomy's  breakdown  of  each  flight  mishap.  Investigating  the  relationships 
between  causal  factors  in  the  taxonomy  will  suggest  where  intervention  strategies  should 
be  focused.  In  addition,  by  modeling  FMs  as  Poisson  Processes,  the  impact  of  these 
intervention  strategies  is  estimated. 

The  analysis  and  impact  of  the  intervention  is  complicated  because  HE  types  in 
the  HFACS  taxonomy  share  an  involved  dependence  structure.  The  HFACS  taxonomy 
allows  a  single  FM  to  be  given  multiple  causal  factors,  the  causal  factors  or  HEs  are  not 
mutually  exclusive.  Given  that  there  are  17  basic  types  of  HE  labeled  I,...,  Y  (Figure  2) 
with  a  hierarchical  structure,  this  yields  a  very  complex  conditional  framework  to  the 
HFACS  taxonomy.  This  complicates  the  dependencies  between  causal  factors  to  a  point 
where  basic  statistical  analysis  and  modeling  becomes  extremely  difficult  and  the  use  of 
simulation  techniques  in  conducting  the  analysis  is  more  promising  in  obtaining  a 
working  solution.  Based  on  original  flight  mishap  data  and  a  Poisson  arrival  process  for 
FMs,  a  simulation  model  is  built  to  simulate  future  accidents  and  predict  the  HE 
characteristics  of  these  accidents.  From  this  simulation  model,  the  ability  to  estimate  the 
expected  number  of  accidents  for  a  specified  number  of  flight  hours  and  predict  specific 
HE  types  involved  in  the  FMs  is  possible. 
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A.  NAVAL  SAFETY  CENTER  DATABASE 

The  NSC  maintains  a  database,  Safety  Information  Management  System  (SIMS), 
of  all  reported  TACATR  flight  mishaps.  In  1998,  Naval  Aviation  (NA)  psychologists  at 
the  NSC  took  all  human  factors  TACAIR  Class  A  FMs  from  fiscal  year  (FY)  90  to  FY98 
and  classified  them  according  to  the  HFACS  taxonomy.  This  classification  of  the  Class 
A  TACAIR  FMs  by  the  NSC  is  used  for  the  analysis.  The  database  is  also  queried  for  all 
Class  B  human  factors  TACAIR  FMs  from  FY90  to  FY98  to  be  used  in  the  analysis.  The 
Class  B  TACAIR  FMs  are  classified  according  to  the  HFACS  taxonomy  by  the  author, 
using  the  MIRs  descriptions  of  causal  factors  in  the  TACAIR  FMs.  There  are  122  Class 
A  TACAIR  FMs  and  19  Class  B  TACAIR  FMs,  from  FY90  to  FY97  that  were 
categorized  as  human  factors  flight  mishaps  (FM).  For  FY98,  there  are  12  Class  A 
TACAIR  FMs  and  zero  Class  B  TACAIR  FMs  identified  as  human  factors  flight 
mishaps.  The  data  for  FY98  is  set  aside  to  validate  the  results  of  the  simulation  model, 
which  is  built  using  FY90  to  FY97  data. 

B.  MISHAP  INVESTIGATION  REPORTS  (MIR) 

MIRs  contain  investigative  data  relating  to  the  aircraft  flight  mishap.  They  are 
received  by  the  NSC  in  the  form  of  message  traffic  and  written  enclosures  to  the  MIR  and 
are  entered  into  the  SIMS  database.  They  contain  an  extensive  narrative  of  the  flight 
mishap  and  supporting  information  of  the  FM  pilot  and  FM  aircraft,  and  identifiable 
contributing  FM  causal  factors.  The  MIRs  for  all  Class  A  flight  mishaps  are  quite 
thorough  and  the  quality  of  Class  B  MIRs  vary  depending  on  the  severity  of  the  FM.  the 
greater  the  damage  the  more  thorough  the  investigation.  Since  the  quality  of  Class  B 
MIRs  varied,  only  those  FMs  that  were  thoroughly  investigated  are  included  in  the  study. 

C.  FLIGHT  MISHAP  CLASSIFICATION 

The  Class  A  and  B  FMs  that  are  classified  according  to  the  HFACS  taxonomy  are 
entered  into  a  Microsoft  Excel  97  spreadsheet.  This  creates  25  columns  of  binary 
variables,  one  for  each  type  of  HE  (Figure  2).   A  "1"  indicates  the  HE  type  is  present  in 
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that  FM,  "0"  otherwise.  This  puts  the  data  in  a  matrix  that  will  allow  an  exploratory 
analysis  to  be  conducted  on  the  data  using  statistical  computing  tools,  such  as  S-Plus®. 
The  columns  of  the  spreadsheet  consist  of  categorical  data  including  date  of  occurrence, 
aircraft  type  and  a  listing  of  all  HFACS  causal  factors.  Each  row  of  the  spreadsheet 
corresponds  to  individual  FMs.  For  ease  in  coding,  instead  of  using  the  HE 
nomenclature,  the  columns  are  identified  using  a  single  letter  for  each  type  of  HE  (Figure 
2). 


Human  Factors  Analysis  and  Classification 


rs      |  E/135  |    Violations  |  F/43 
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to  Supervisor^  I     Resource    I  Organizational]  Organizational! 


Physical/ 
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Figure  2.  HFACS  taxonomy:  text  next  to  the  causal  factor  codes  the  factors  A,...,  Y  and 
gives  the  number  of  FMs  the  factor  is  associated  with.  For  example,  A/141  codes  Unsafe 
Acts  as  "A"  and  in  141  FMs  Unsafe  Acts  were  cited  as  a  causal  factor. 


D.         OVERVIEW  OF  ANALYSIS 

Grouping  HE  types  into  levels  using  the  hierarchical  structure  of  the  HFACS 
taxonomy  in  Figure  2  facilitates  the  analysis  of  the  NA  Class  A  and  B  FMs  studied. 
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There  are  three  basic  levels  in  Figure  2  of  the  HFACS  taxonomy.  They  are  categorized  in 
a  hierarchical  relationship  with  the  lower  levels  being  subsets  of  HE  types  contained  in 
the  higher  levels.  The  lowest  level  is  defined  by  the  HE  types  coded  I....Y  in  Figure  2  and 
these  compose  the  nuclei  of  the  HFACS  taxonomy.  All  HE  types  in  higher  levels  are 
composed  of  groupings  of  lower  level  HE  types.  The  middle  level  is  defined  by  the  HE 
types  coded  E,  F,  G,  H,  C,  and  D  in  Figure  2.  HE  types  A,  B,  C,  and  D  in  Figure  2  define 
the  highest  level  in  Figure  2.  As  an  example  of  the  hierarchical  nature  of  the  sets,  the 
middle  level  HE  type  E  is  made  up  of  all  FMs  that  cited  either  HE  type  I,  J.  or  K. 
Through  a  visual  analysis  of  Figure  2,  this  hierarchical  relationship  discussed  between  HE 
types  is  readily  apparent. 

Statistical  analysis  is  conducted  separately  for  each  level  of  the  HFACS  hierarchy 
to  identify  relevant  causal  factors  and  predictive  patterns  found  in  the  data.  The  lowest 
level  of  the  HFACS  taxonomy  will  receive  the  majority  of  the  analysis  since  the  HE  types 
contained  in  this  level  define  all  other  levels.  The  correlation  between  the  occurrence  of 
causal  factors  in  FMs  for  each  level  is  evaluated  to  determine  any  important  pairwise 
relationships.  A  cluster  analysis  is  performed  to  identify  important  groupings  of  multiple 
HE  types  within  each  level  using  the  function  Mona  in  S-Plus©.  A  matrix  of  subset 
relationships  is  developed  to  identify  important  interrelations  between  the  HE  types  in 
each  level.  To  determine  the  validity  of  assuming  a  Poisson  arrival  process  for  FMs,  a  log 
linear  model  of  the  Class  A  and  B  FM  occurrences  is  constructed  using  flight  hour  and 
accident  data  from  FY90  to  FY97  for  Naval  Aviation  TACAIR. 

A  simulation  model  is  developed  in  light  of  the  complicated  dependencies  among 
HE  types  in  FMs  using  S-Plus©.  This  simulation  is  a  form  of  bootstrapping  (see  Davison 
&  Hinkley,  1997)  that  sheds  light  on  the  results  that  classical  statistics  cannot.  First,  the 
simulation  model  generates  FMs  based  upon  a  Poisson  Process  with  arrival  rate  estimated 
from  historical  data.  For  each  FM,  the  HE  types  are  then  generated.  These  are  modeled 
directly  using  the  empirical  distribution  of  the  historical  HE  type  combinations.  This 
distribution  is  composed  of  all  Class  A  and  B  TACAIR  FMs  from  FY90  to  FY97  and  is 
seen  as  fair  representation  of  the  distribution  of  HE  types  found  in  Naval  Aviation 
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TACAIR  flight  mishaps.    Potential  intervention  strategies  are  identified  based  on  the 
simulation  results  and  are  compared  to  FY98  flight  mishaps. 
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IV.       RESULTS 

The  purpose  of  the  data  analysis  is  to  determine  important  relationships  between 
the  25  causal  factors  in  the  Human  Factors  Analysis  and  Classification  System  (HFACS) 
taxonomy  (A  -  Y  of  Figure  2)  and  verify  that  the  accident  arrivals  for  the  Class  A  and  B 
Tactical  Aircraft  (TACAIR)  Human  Error  (HE)  Flight  Mishaps  (FMs)  can  be  modeled  as 
a  Poisson  Process.  The  data  used  for  the  analysis  are  the  141  Class  A  and  B  TACAIR 
FMs  between  fiscal  year  (FY)  90  and  FY97  that  cited  HE  as  the  primary  causal  factor 
(FMs  due  entirely  to  mechanical  or  maintenance  human  factors  were  excluded).  The 
TACAIR  FMs  for  FY98  are  set  aside  to  validate  the  flight  mishap  (FM)  rate  of  the  model. 

A.    DATA  ANALYSIS  OF  CAUSAL  FACTORS 

Classifying  the  141  FMs  according  to  the  HFACS  taxonomy  (Figure  2)  gives  a 
binary  row  vector  of  1  's  and  0's  for  each  flight  mishap.  A  "1"  indicates  that  causal  factor 
is  cited  in  the  FM,  a  "0"  indicates  that  causal  factor  is  not  cited  in  the  flight  mishap. 
Combining  these  vectors  gives  a  141x25  binary  asymmetric  matrix  X  with  FMs  defining 
the  rows  and  the  HE  types  defining  the  columns.  In  addition,  we  define  sets  for  analysis 
corresponding  to  each  causal  factor  to  be  subsets  of  FMs  that  cited  that  causal  factor 
(Table  1).  Exploration  of  the  data  is  undertaken  by  analyzing  the  relationship  between 
these  sets. 


33 


1.  Notation  and  Structure  Data 

For  initial  data  exploration,  the  HE  types  correspond  to  sets  of  FMs  that  exhibit 
that  HE  as  defined  in  Table  1 .  The  relationships  between  the  sets  are  defined  as: 

(AuBuCuD)  =  XX,  (1) 

(E  u  F)  =  A,  (2) 

(GuH)  =  B,  (3) 

(SuTuUuV)  =  C,  (4) 

(WuXuY)  =  D,  (5) 

(IuJuK)  =  E,  (6) 

(LuM)  =  F,  (7) 

(NuOuP)  =  G,  (8) 

(QuR)  =  H.  (9) 

Note  that  sets  on  the  left-hand  side  of  equations  (1)  to  (9)  are  not  necessarily  mutually 

exclusive.     There  is  a  hierarchical  relationship  between  these  sets  as  shown  in  set 

equations  (1)  to  (9)  and  visually  in  Figure  2.  This  relationship  is  used  to  infer  findings  in 

the  lowest  level  to  higher  level  HE  types,  which  is  important  because  it  allows  the  study 

to  focus  on  the  most  basic  HE  types.   The  corresponding  HE  types  at  the  bottom  of  the 

HFACS  in  Figure  2  are  exhaustive  in  their  classification  of  error.   They  are  considered 

subsets  of  the  HE  types  defined  in  the  higher  levels.   For  example,  see  equation  (9),  HE 

type  E  (Error)  contains  all  FMs  that  cited  either  HE  type  I  (Skill-Based  Error),  J  (Decision 

Error)  or  K  (Perceptual  Error)  or  any  combination  of  the  three. 

Three  classes  of  sets  are  constructed  using  this  subset  relationship.  Each  class 
represents  a  level  of  classification  in  the  HFACS  hierarchy.  The  first  class  HFACSA  is 
built  from  the  top  level  (Figure  2),  sets  A,  B,  C  and  D  (Table  1),  the  second  class 
HFACSB  is  built  from  the  middle  level  (Figure  2),  sets  E,  F.  G.  H.  C  and  D  (Table  1), 
and  the  third  class  HFACSC  is  built  from  the  bottom  level  (Figure  2),  sets  I,...,Y  (Table 
1).  Appendix  E  contains  a  key  for  HE  types  coding. 
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Table  1.  Set  definitions  for  HFACS  sets  A...Y  and  the  Universal  set  XX.  Example:  set  A 
contains  all  FMs  that  identified  A  as  a  causal  factor. 


Set  Definitions: 


XX   =    { all  TACAIR  human  factors  Class  A  &  B  FMs  from  FY90  to  FY97,  excluding 
excluding  those  FMs  attributable  to  mechanical  or  maintenance  human  factors} 
I  xx  cited  as  a  causal  factor  Unsafe  Acts} 
I  xx  cited  as  a  causal  factor  Preconditions  for  Unsafe  Acts} 
I  xx  cited  as  a  causal  factor  Unsafe  Supervision} 
I  xx  cited  as  a  causal  factor  Organizational  Influences} 
I  xx  cited  as  a  causal  factor  Errors} 
I  xx  cited  as  a  causal  factor  Violations} 

I  xx  cited  as  a  causal  factor  Substandard  Conditions  of  Operators} 
I  xx  cited  as  a  causal  factor  Substandard  Practices  of  Operators} 
I  xx  cited  as  a  causal  factor  Skill-Based  Errors} 
I  xx  cited  as  a  causal  factor  Decision  Errors} 
I  xx  cited  as  a  causal  factor  Perceptual  Errors} 
I  xx  cited  as  a  causal  factor  Infraction} 
I  xx  cited  as  a  causal  factor  Exceptional} 
I  xx  cited  as  a  causal  factor  Adverse  Physiological  State} 
I  xx  cited  as  a  causal  factor  Adverse  Mental  State} 
I  xx  cited  as  a  causal  factor  Physical/Mental  Limitation} 
I  xx  cited  as  a  causal  factor  Crew  Resource  Management  (CRM)} 
I  xx  cited  as  a  causal  factor  Personal  Readiness} 
I  xx  cited  as  a  causal  factor  Inadequate  Supervision} 
I  xx  cited  as  a  causal  factor  Planned  Inappropriate  Operations} 
I  xx  cited  as  a  causal  factor  Failed  to  Correct  Problem} 
I  xx  cited  as  a  causal  factor  Supervisory  Violation} 
I  xx  cited  as  a  causal  factor  Resource  Management} 
I  xx  cited  as  a  causal  factor  Organizational  Climate} 
I  xx  cited  as  a  causal  factor  Organizational  Process} 


A 

= 

{xx ! 

B 

= 

{xx  1 

C 

= 

{xx  1 

D 

= 

{xx  1 

E 

= 

{xx  1 

F 

= 

{xx  1 

G 

= 

{xx  1 

H 

= 

{xx  1 

I 

= 

{xx  1 

J 

= 

{xx  1 

K 

= 

{xx  1 

L 

= 

{xx  1 

M 

= 

{xx  1 

N 

= 

{xx  1 

0 

= 

{xx  1 

P 

= 

{xx  1 

Q 

= 

{xx  1 

R 

= 

{xx  1 

S 

= 

{xx  1 

T 

= 

{xxl 

U 

= 

{xx  1 

V 

= 

{xxl 

w 

= 

{xx  1 

X 

= 

{xx  1 

Y 

= 

{xxl 

Another  way  to  look  at  these  classes  is  by  identifying  them  with  the  matrix  X 
defined  at  the  beginning  of  Chapter  IV.  X  is  a  141x25  matrix  with  all  HFACS  HE  types 
defining  the  columns  and  all  141  FMs  between  FY90  and  FY97  defining  the  rows.  The 
first  class  corresponds  to  the  four  columns  of  X,  which  are  indicators  for  sets  A,  B,  C  and 
D.  Extracting  these  four  columns  from  X  gives  a  141x4  matrix  that  is  equivalent  to  the 
first  class;  these  four  column  vectors  define  the  matrix  XA.  The  second  class  corresponds 
to  column  vectors  E,  F,  G,  H,  C  and  D  of  X.  Extracting  these  six  columns  from  X  gives  a 
141x6  matrix  that  is  equivalent  to  the  second  class;  these  six  column  vectors  define  the 
matrix  XB.  The  third  set  corresponds  to  column  vectors  I,...,Y  of  X.  Extracting  these  17 
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columns  from  X  gives  a  141x17  matrix  that  is  equivalent  to  the  third  class;  these  17 
column  vectors  define  the  matrix  Xc.  All  FMs  contained  in  classes  HFACSA,  HFACSB 
and  HFACSC  are  also  contained  in  their  respective  matrices  XA,  XB  and  Xc  along  with  the 
corresponding  FM  causal  factors.  Looking  at  the  classes  and  the  matrices  one  should 
again  note  that  none  of  the  sets  is  mutually  exclusive,  a  single  FM  may  belong  to  many 
different  sets.  For  this  reason,  there  are  multiple  dependent  relationships  among  the  HE 
types.  Analysis  using  the  simple  probability  of  a  HE  types  occurrence  cannot  be  used  in 
the  exploration  of  relationships  in  the  HFACS  taxonomy. 
2.         Analysis  of  Pairwise  Dependency 

To  take  an  initial  look  at  the  relationship  between  HE  types,  correlation  matrices 
are  calculated  for  the  columns  of  XA,  XB  and  Xc  (Appendix  A).  The  highest  correlation 
for  all  three  matrices  is  in  Xc  between  set  N  (Adverse  Physiological  State)  and  K 
(Perceptual  Errors)  with  a  correlation  of  .623.  After  this,  the  highest  correlation  is  .409 
between  sets  U  (Failed  to  Correct  Problem)  and  V  (Supervisory  Violation)  in  the  matrix 
Xc.  All  correlations  otherwise  range  between  -.287  and  .344  for  all  three  matrices.  The 
accident  data  is  examined  and  the  relationship  between  N  and  K  is  found  to  have  a  mild 
positive  relationship.  In  addition,  U  and  V  are  found  to  have  an  even  milder  positive 
relationship.  The  correlation  between  N  and  K  addresses  23  FMs  (Table  2),  and  the 
correlation  between  U  and  V  only  addresses  4  flight  mishaps.  The  fact  that  the  only 
potentially  important  relationships  in  the  correlations  are  found  in  Xc  is  not  surprising 
given  the  hierarchical  nature  of  the  HFACS  taxonomy.  Since  the  upper  levels  of  the 
HFACS  taxonomy  are  defined  by  lower  level  sets,  the  correlations  are  diminished  in 
significance  as  one  proceeds  up  the  classifications  in  the  taxonomy. 

From  this  point  on,  this  analysis  will  concentrate  on  the  class  HFACSC.  The 
reason  for  concentrating  on  HFACSC  is  that  the  HE  types  defining  this  class  are  the  most 
substantive  HE  types.  They  are  an  exhaustive  listing  of  HE  types  that  are  used  to  define 
the  sets  in  the  higher  classes  of  the  HFACS  taxonomy.  The  intent  of  further  study  is  to 
concentrate  on  the  more  specific  HE  types  of  HFACSC.  This  can  be  done  without  loss  of 
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generality  since  all  sets  in  the  class  HFACSC  are  subsets  of  sets  in  both  classes  HFACSB 
and  HFACSA  as  defined  in  set  equations  (1)  -  (9). 

To  look  more  closely  at  HFACSC,  we  first  compute  a  matrix  that  defines  the 
number  of  FMs  that  cite  a  specific  HE  type  and  the  combinations  of  HE  types  (Table  2), 

Mc  =  (XC)T  (Xc).  (10) 

The  rows  and  columns  of  Mc  are  indexed  by  i,  j  =  I,...,Y,  let  each  mc(i,j)  be  the  number 
of  FMs  in  the  intersection  of  sets  i  and  j.  Then  mc(i,i)  defines  the  number  of  FMs 
contained  in  set  i.  As  an  example,  mc(N,K)  =  23,  is  the  number  of  FMs  in  the  intersection 
of  sets  N  and  K,  so  23  FMs  between  FY90  and  FY97  cited  both  HE  type  N  and  K  as 
causal  factors  in  the  FM. 

To  calculate  the  proportions,  FMs  in  pairwise  intersections  of  HEs,  let  Pc  be  the 
proportion  matrix, 

Pc  =  mc(i,j)/141  Vi,j,  (11) 

where  141  is  the  total  number  of  FMs  in  FY90  to  FY98.  The  diagonal  of  this  matrix 
gives  P(  i  ),  the  proportion  of  total  FMs  citing  HE  type  "i"  to  the  total  number  of  FMs 
studied  (Table  3).  All  other  cells  give  P(in  j),  the  proportion  of  total  FMs  citing  HE 
type  "i"  and  "j"  in  combination  to  the  total  number  of  FMs  studied  (Table  3).  A  notable 
observation  in  the  analysis  is  that  proportion  Pc(U)  or  the  proportion  of  FMs  with  HE  i  is 
not  the  sum  of  Pc(i,j)  for  all  j,  because  of  the  non-mutually  exclusive  character  of 
HFACS. 
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Table  2.  Matrix  Mc  (Intersection  of  Sets).  Example,  at  cell  mc(I,J),  the  intersection  of 
sets  I  and  J  indicates  that  38  of  141  FMs  between  FY90  and  FY97  shared  the  causal 
factor  combination  of  I  and  J.  At  cell  mc(I,I)  there  are  87  FMs  indicating  that  HE  type  I 
was  cited  as  a  causal  factor  in  87  of  141  FMs  between  FY90  and  FY97. 
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87  38 
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23 
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4 

8 

3 

3 
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9 

1 
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29 

5 

9 
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12 

2 

7 

1 

4 

3 

5 

1 

7 
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19 

5 

9 

2 

9 

2 

2 

2 

1 

0 

3 

1 

2 
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30 

25 

2 

12 

3 

7 

2 

3 

2 

9 

1 

8 
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96 

7 

49 

6 

23 

14 

8 

9 

27 

1 

30 

P 

8 

5 

1 

1 

0 

1 

1 

3 

0 

2 

Q 

69 

2 

15 

7 

4 

5 

14 

1 

20 

R 

7 

4 

1 

1 

1 

0 

0 

2 

S 

33 

8 

3 

5 

8 

0 

12 

T 

16 

0 

1 

4 

0 

6 

U 

8 

4 

3 

1 

2 

V 

10 

4 

0 

3 

w 

37 

0 

15 

X 

1 

0 

Y 

43 

Table  3.   The  proportion  matrix  Pc,  the  diagonal  of  this  matrix  gives  the  P  (  i  )  and  all 
other  cells  give  the  P  (i  n  j)  for  all  i  and  j. 


I    J 
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N 

O 

P 

0 

R 

s 

T 

u 

V 

w 

X 

Y 
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0.62  0.27 

0.11 

0.10 

0.04 

0.13 

0.46 

0.04 

0.31 

0.03 

0.13 

0.06 

0.04 

0.06 

0.17 

0.01 

0.18 

J 

0.53 

0.09 

0.11 

0.08 

0.08 

0.36 

0.01 

0.32 

0.02 

0.14 

0.09 

0.04 

0.05 

0.13 

0.00 

0.19 

K 

0.25 

0.09 

0.05 

0.16 

0.20 

0.01 

0.11 

0.03 

0.06 

0.02 

0.02 

0.01 

0.06 

0.01 

0.05 

L 

0.21 

0.04 

0.06 

0.12 

0.01 

0.09 

0.01 

0.05 

0.01 

0.03 

0.02 

0.04 

0.01 

0.05 

M 

0.13 

0.04 

0.06 

0.01 

0.06 

0.01 

0.01 

0.01 

0.01 

0.00 

0.02 

0.01 

0.01 

N 

0.21 

0.18 

0.01 

0.09 

0.02 

0.05 

0.01 

0.02 

0.01 

0.06 

0.01 

0.06 

O 

0.68 

0.05 

0.35 

0.04 

0.16 

0.10 

0.06 

0.06 

0.19 

0.01 

0.21 

P 

0.06 

0.04 

0.01 

0.01 

0.00 

0.01 

0.01 

0.02 

0.00 

0.01 

Q 

0.49 

0.01 

0.11 

0.05 

0.03 

0.04 

0.10 

0.01 

0.14 

R 

0.05 

0.03 

0.01 

0.01 

0.01 

0.00 

0.00 

0.01 

s 

0.23 

0.06 

0.02 

0.04 

0.06 

0.00 

0.09 

T 

0.11 

0.00 

0.01 

0.03 

0.00 

0.04 

U 

0.06 

0.03 

0.02 

0.01 

0.01 

V 

0.07 

0.03 

0.00 

0.02 

w 

0.26 

0.00 

0.11 

X 

0.01 

0.00 

Y 

0.30 
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An  important  part  of  this  analysis  is  looking  at  the  conditional  proportions  of  FMs 
in  the  intersection  of  HE  sets.  To  determine  these  conditional  proportions,  let  Sc  be  the 
matrix, 

Sc  =  mc(ij)/mc(i,i)       Vi,j.  (12) 

The  entries  of  Sc  give  the  proportion  of  FMs  citing  a  specific  causal  factor  given  that  FM 

also  cites  another  causal  factor  (Table  4).   For  example,  at  cell  (O,  T),  (read  column  to 

row)  (.88  x  100)  percent  of  the  time  given  an  FM  cites  HE  type  T  (Planned  Inappropriate 

Operations)  as  a  causal  factor,  that  FM  will  also  cite  HE  type  O  (Adverse  Mental  State)  as 

a  causal  factor. 

Table  4.  The  subset  matrix  Sc.  Example,  at  cell  (O,  T),  (in  order  to  read  the  relationship 
correctly,  read  the  column  causal  factor  first.  Then  read  the  row  causal  factor  in  the 
following  statement)  when  HE  type  T  is  cited  in  an  accident,  (.88  x  100)  percent  of  the 
time  HE  type  O  is  also  cited  in  that  mishap. 
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0.51 

0.46 

0.48 

0.26 

0.60 

0.68 

0.75 

0.64 

0.57 

0.58 

0.56 

0.75 

0.90 

0.65 

1.00 

0.58 

J 

0.44 

0.34 

0.55 

0.58 

0.37 

0.53 

0.13 

0.65 

0.43 

0.61 

0.75 

0.75 

0.70 

0.49 

0.00 

0.63 

K 

0.18 

0.16 

0.41 

0.37 

0.77 

0.29 

0.25 

0.22 

0.57 

0.24 

0.19 

0.38 

0.20 

0.24 

1.00 

0.16 

L 

0.16 

0.21 

0.34 

0.26 

0.30 

0.18 

0.13 

0.17 

0.29 

0.21 

0.06 

0.50 

0.30 

0.14 

1.00 

0.16 

M 

0.06 

0.15 

0.20 

0.17 

0.17 

0.09 

0.25 

0.13 

0.29 

0.06 

0.13 

0.13 

0.00 

0.08 

1.00 

0.05 

N 

0.21 

0.15 

0.66 

0.31 

0.26 

0.26 

0.25 

0.17 

0.43 

0.21 

0.13 

0.38 

0.20 

0.24 

1.00 

0.19 

O 

0.75 

0.68 

0.80 

0.59 

0.47 

0.83 

0.88 

0.71 

0.86 

0.70 

0.88 

1.00 

0.90 

0.73 

1.00 

0.70 

P 

0.07 

0.01 

0.06 

0.03 

0.11 

0.07 

0.07 

0.07 

0.14 

0.03 

0.00 

0.13 

0.10 

0.08 

0.00 

0.05 

Q 

0.51 

0.60 

0.43 

0.41 

0.47 

0.40 

0.51 

0.63 

0.29 

0.45 

0.44 

0.50 

0.50 

0.38 

1.00 

0.47 

R 

0.05 

0.04 

0.11 
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0.36 

0.20 

0.24 

0.11 

0.27 
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0.29 
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0.36 
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0.25 

0.30 
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0.00 

For  purposes  of  identifying  important  conditional  proportions  in  the  matrix  in 
Table  4,  a  floor  of  (.70x100)  percent  is  set  for  that  case  to  be  considered  in  further 
analysis.  There  are  19  such  sets  which  meet  the  70  percent  floor  in  Table  4  (entries  in  the 
X  column  are  not  considered  since  they  represent  only  one  FM  and  do  not  provide  any 
insight  into  other  flight  mishaps).  These  sets  are  listed  in  Table  5.   The  most  important 
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combinations  contain  HE  type  O  (Adverse  Mental  State)  the  largest  proportion  of  the 
time,  12  of  19  times  in  Table  5.  The  most  important  combinations  after  these  are  I  (Skill- 
Based  Error)  3  of  19  and  J  (Decision  Error)  3  of  19.  Clearly,  Adverse  Mental  State  stands 
out  as  a  consequential  factor  in  Table  4. 

To  explore  these  stronger  relationships  found  in  the  analysis  and  listed  in  Table  5, 
a  simulation  model  is  constructed  to  predict  the  character  and  occurrence  of  future  HE  in 
Naval  Aviation  TACAIR  Class  A  and  B  flight  mishaps.  By  using  historical  FM  data,  we 
can  simulate  the  conditional  proportion  of  HE  types  and  then  construct  confidence 
intervals  (CIs)  based  on  the  simulated  occurrence  of  the  HE  types,  to  determine  their 
statistical  significance. 

Table  5.  Important  Subsets  in  Table  4.  For  example:  P  c  O,  87.5  percent  of  all 
accidents  citing  causal  factor  P  also  cited  causal  factor  O. 


Relationships 

Percentage 

U    e 

O 

100.0 

P     c 

o 

87.5 

T     c 

o 

87.5 

R     c 

o 

85.7 

V     C 

o 

81.8 

V     c 

I 

81.8 

N     e 

o 

80.6 

K    c 

o 

78.3 

N    c 

K 

77.4 

P     c 

I 

75.0 

T      C 

J 

75.0 

U    c 

I 

75.0 

U    c 

J 

75.0 

I      c 

o 

73.8 

V     c 

J 

72.7 

S     c 

o 

70.5 

0    c 

o 

70.4 

Y    c 

o 

70.0 

w   c 

() 

70.0 
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3.  Cluster  Analysis 

Cluster  analysis  of  the  data  is  accomplished  using  a  monothetic  clustering  method 
for  analysis  of  matrices  with  asymmetric  binary  variables  (Kaufman  &  Rousseeuw, 
1990).  This  method  takes  advantage  of  the  binary  asymmetric  structure  of  the  HFACS 
matrices.  The  method  clusters  the  data  according  to  its  combination  of  l's  and  O's.  This 
method  is  applied  to  all  three  sets  using  the  function  mona  in  S-Plus®  with  the  following 
results: 

1)  HFACS  A  with  four  sets  has  24  combinations  and  it  clustered  into  eight 
separate  combinations. 

2)  HFACSB  with  six  sets  has  26  combinations  and  it  clustered  into  32  separate 
combinations. 

3)  HFACSC  with  17  sets  has  217  combinations  and  it  clustered  into  121  separate 
combinations. 

The  121  combinations  used  by  Mona  to  cluster  HFACSC  covered  141  accidents,  13 
combinations  shared  multiple  accidents,  while  108  accidents  are  unique  combinations 
(see  Table  6  for  listing  of  multiple  accidents  sharing  the  same  causal  factor 
combinations). 

Within  the  cluster  analysis  of  all  141  accidents,  certain  combinations  appear 
dominant,  as  can  be  partially  seen  in  Table  6  and  are  fully  listed  in  Table  7  for  the  121 
separate  combinations  found  in  the  cluster  analysis.  It  can  be  seen  that  O  (Adverse 
Mental  State)  and  Q  (CRM)  appear  in  combination  with  other  causal  factors  a  large 
proportion  of  the  time.  Of  the  17  causal  factors,  there  are  four  factors  which  reoccur 
repeatedly  in  all  accident  combinations,  these  are  O  (Adverse  Mental  State),  Q  (Crew 
Resource  Management  (CRM)),  I  (Skill-Based  Errors),  and  J  (Decision  Errors).  This 
pattern  can  also  be  seen  in  an  analysis  of  pairwise  dependency  in  the  sets,  where  O 
(Adverse  Mental  State)  was  identified  as  the  most  important  factor  in  the  analysis.  It  can 
be  seen  in  Table  7  that  Adverse  Mental  State  is  also  contained  in  6  of  the  9  important 
combinations  identified  in  the  cluster  analysis.  This  agreement  in  each  analysis  as  to  the 
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importance  of  Adverse  Mental  State  highlights  the  significance  of  HE  type  O  (Adverse 

Mental  State)  in  Naval  Aviation  TACAIR  flight  mishaps. 

Table  6.   Combinations  of  causal  factors  which  are  common  to  more  than  one  accident. 
Example,  three  accidents  share  the  same  causal  factor  combination  of  I  and  Q. 


Accidents 

Combinations  of  Causal  Factors 

Two 

I 

I,  O,  W,  Y 

I,0,Q 

I,  O,  Q,  W 

1 1  Q-  Y 

I.  J,  O.  Q.  Y 

I.  J,  L.  0.  Q 

I.  K,  N,  0.  Q 

J,Q 

j,o 

Three 

I,Q 

Four 

1,0 

Five 

I.  J.  O.  Q 

Table  7.  Percent  of  accidents  having  the  specific  causal  factor  combinations.  Example, 
for  the  combination  O  &  J  (Adverse  Mental  State  and  Decision  Error)  50  percent  of  all 
accidents  studied  had  both  of  these  listed  as  causal  factors  in  the  accident. 


Combinations. 

Percent  of  Accidents 

O&I 

50% 

O&J 

40% 

O&Q 

39% 

O&K 

21% 

O&Y 

24% 

O&W 

21  % 

I&J 

29% 

Q&J 

35% 

O&I 

32% 

B. 


ANALYSIS  OF  ACCIDENT  ARRIVAL  RATES 


A  general  log  linear  regression  model  that  hypothesizes  a  Poisson  distribution 
with  rate  proportional  to  flight  hours  supports  the  assumption  that  the  accident  arrival  rate 
follows  a  Poisson  Process.  Data  used  to  construct  the  log  linear  regression  model  are 
flight  hours  for  Naval  TACAIR  for  FY90  to  FY97  and  the  number  of  Class  A  and  B 
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TACAIR  FMs  for  FY90  -  FY97  (Table  8).  The  regression  model  uses  the  expected  value 
of  a  Poisson  arrival  process  to  test  the  hypothesis  that  the  data  is  from  a  Poisson 
distribution  with, 

E(TAC AIR  FMs)  =  Xl.  (13) 

where  X  is  the  accident  arrival  rate/ 100,000  flight  hours  and  t  is  flight  hours  per 
year/ 100,000.  Taking  the  natural  log  (In)  of  both  sides  yields  a  log  linear  equation  for 
regression, 

ln[E(TACAIR  FMs)]  =  ln(?i)  +  ln(t).  (14) 

Restating  equation  (14)  using  regression  coefficients  and  variables,  gives  the  following 
equation: 

ln[E(TACAIR  FMs)]  =  Po  +  piXi,  (15) 

where  Po  =  \n(k),  pi  is  the  regression  coefficient  for  Xj  and  xi  =  ln(t). 

If  equation  (15)  is  considered  representative  of  a  Poisson  process,  then  pi  must 
equal  one.  To  test  the  hypothesis,  H0:  Pi  =  1,  the  data  in  Table  8  is  fit  to  a  log  linear 
model  (equation  (15)).  Using  S-Plus©  to  calculate  the  coefficients  and  variables  of  the 
log  linear  regression  model,  a  95  percent  confidence  interval  (CI)  of  (.6527,  3.014)  is 
found  for  pi.  Since  1  is  contained  in  the  95  percent  CI,  at  an  a  =  .05,  the  hypothesis  that 
pi  =  1  cannot  be  rejected  and  the  distribution  is  assumed  to  be  Poisson  with  the  rate 
proportional  to  flight  hours. 

Table  8.  Flight  Hours  and  Human  Factors  Class  A  and  B  TACAIR  FMs  FY90  to  FY98. 


Fiscal  Year 

Right 

Class  A  and  B  TACAIR 

Hours 

Human  Factors  FMs 

90 

633.228 

26 

91 

660,314 

23 

92 

597,393 

15 

93 

577,133 

23 

94 

522,700 

9 

95 

503,559 

16 

96 

479,577 

18 

97 

421,150 

11 

98 

406.777 

12 
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C.         SIMULATION 

The  simulation  is  built  using  S-Plus©  (see  Appendix  C  for  simulation  code)  with 
two  principle  assumptions: 

1 )  That  accident  arrivals  can  be  modeled  using  a  Poisson  Process. 

2)  All  HE  types  for  future  FMs  can  be  modeled  from  the  121  distinct  accident 
combinations  found  in  the  Monothetic  cluster  analysis  (Mona). 

To  run  a  simulation,  the  average  accident  arrival  rate  from  FY90  to  FY97  is  used 
along  with  FY98  flight  hours/ 100,000  (Table  8)  to  generate  accidents  from  a  Poisson 
distribution,  where  the  average  accident  arrival  rate  is  assumed  to  be  the  sum  of  the  flight 
hours/ 100,000  from  FY90  to  FY97  divided  by  the  sum  of  the  Class  A  and  B  TACAIR 
FMs  from  FY90  to  FY97  (Figure  3).  Each  iteration  generates  an  observation  from  the 
Poisson  distribution;  this  sets  the  number  of  accidents  for  that  simulated  period.  In  a 
simulation  there  are  1000  iterations,  each  iteration  representing  one  time  period  with  its 
own  specific  number  of  flight  mishaps. 

The  characteristics  of  individual  accidents  for  each  period  are  determined  by  a 
uniform  random  selection  between  1  and  141  (the  total  number  of  TACAIR  Class  A  and 
B  FMs  FY90  -  FY97),  the  FM  characteristics  based  on  the  141  historical  HE  types  found 
in  FY90  to  FY97  flight  mishaps.  This  is  equivalent  to  a  nonparametric  sampling 
bootstrap  with  replacement  from  the  empirical  distribution  of  historical  FM 
characteristics.  This  allows  for  formal  inference. 

Based  on  the  Naval  Aviation  TACAIR  Class  A  and  B  FM  rate  from  FY90  to 
FY97,  the  accident  arrival  rate  is  3.21  FMs/100,000  flight  hours.  Using  the  Class  A  and 
B  TACAIR  flight  mishap  rate,  the  simulation  model  can  be  validated  with  FY98  flight 
hours.  To  compute  the  distribution  of  FMs  predicted  for  FY98,  use  the  accident  arrival 
rate  for  FY90  to  FY97  and  the  flight  hours  flown  in  FY98  and  run  it  through  two 
thousand  iterations  in  the  simulation  model.  Using  408,500  flight  hours  flown  for  FY98. 
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the  results  of  the  simulation  are  an  expected  value  of  13  FMs  in  FY98,  the  actual  accident 
rate  for  FY98  is  12  flight  mishaps. 


Accidents  and  Accident  Rate  FY90  -  FY98 


□  Rate  □  Accidents 


Rate 


Figure  3.  Class  A  and  B  TACAIR  average  accident  arrival  rate/ 100,000  flight  hours  from 
FY90  to  FY98. 


The  frequency  of  important  HE  types,  found  to  be  important  both  singularly  and 
in  combination  (Table  5)  in  earlier  analysis,  is  calculated  for  the  simulation  run. 
Important  singular  HE  types  are  considered  from  earlier  analysis  to  be  Adverse  Mental 
State,  Skill  Based  Errors,  Decision  Errors,  Crew  Resource  Management  and 
Organizational  Process,  each  of  these  has  a  proportion  of  occurrence  greater  than  .30 
(Table  4). 

For  the  simulation  run  of  1000  iterations,  Figure  4  displays  the  histogram  of  the 
accident  arrival  rate.  The  mean  and  95  percent  CIs  for  each  HE  type  both  individually 
and  in  combination  (Table  5)  are  computed  and  listed  in  Appendix  B.  For  a  HE  type 
either  individually  or  in  combination  (Table  5)  to  be  considered  significant,  it  is 
hypothesized  that  at  a  =  .05  the  expected  number  of  FMs  predicted  is  greater  than  0.  All 
single  HE  types  that  are  considered  important  and  run  in  the  simulation  are  found  to  be 
significant  at  a  =  .05.  For  the  important  combinations  in  Table  5  only  I  (Skill-Based 
Error)  -  O  (Adverse  Mental  State)  and  Q  (CRM)  -  O  (Adverse  Mental  State)  are 
significant  at  a  =  .05. 
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Figure  4.   Histogram  of  1000  iterations  of  simulation,  showing  the  wide  variance  of  the 
number  of  accidents  yielded  by  the  Poisson  arrival  rate  for  Class  A  and  B  TACAIR  FMs. 

The  results  in  the  simulation  support  the  importance  of  the  HE  type  O  (Adverse 
Mental  State),  exhibited  in  both  the  cluster  analysis  and  the  pairwise  dependency  analysis. 
The  most  substantial  support  from  the  simulation  is  found  in  the  pairwise  combinations, 
where  Adverse  Mental  State  is  in  2  of  2  combinations,  the  only  significant  combinations 
that  are  found  in  the  simulation.  Adverse  Mental  State  is  significant  in  all  three  separate 
types  of  analysis,  emphasizing  the  importance  of  Adverse  Mental  State  in  TACAIR 
human  error  flight  mishaps  between  FY90  and  FY97.  Notably,  there  are  no  other  HE 
types  that  influenced  the  analysis  as  strongly  as  Adverse  Mental  State. 
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V.         SUMMARY,  DISCUSSION  AND  RECOMMENDATIONS 


A.         SUMMARY 

The  study  of  human  error  (HE)  in  Naval  Aviation  (NA)  flight  mishaps  (FM)  does 
not  often  present  a  clear  path  to  a  single  primary  causal  factor.  Accidents,  which  occur 
primarily  due  to  HE,  are  often  composed  of  a  web  of  intertwined  factors  that  contribute  to 
the  accident.  The  recently  developed  Naval  Safety  Center  (NSC)  Human  Factors 
Analysis  and  Classification  System  (HFACS)  assists  in  explicating  the  picture.  Through 
research  and  studies,  Naval  Aviation  psychologists  at  the  NSC  have  taken  approximately 
289  HE  classifications  (Shappel  &  Wiegmann,  1994)  and  clustered  them  into  25  basic 
distinct  HE  types  (Figure  2).  Each  of  these  25  separate  categories  is  a  node  on  this  web 
of  intertwined  causal  factors.  These  nodes  are  composed  of  multiple  types  of  human 
failures  grouped  together  because  of  their  similarities.  Within  each  of  these  nodes  is  a 
web  of  its  own  which  may  appear  clear  and  symmetric  for  analysis  of  any  particular  FM 
or  may  be  tangled  and  chaotic  in  the  analysis  of  the  flight  mishap. 

Whether  a  FM  is  clear  or  tangled,  the  power  in  the  HFACS  taxonomy  is  that  it 
allows  the  researcher  to  classify  many  single  HEs  into  specific  groupings,  allowing  for  a 
focused  analysis.  For  example,  Adverse  Mental  State  in  the  HFACS  taxonomy  is 
composed  of  approximately  ten  individual  types  of  human  error.  These  individual  types 
of  HE  are  grouped  under  a  common  idea,  the  pilot  is  not  mentally  prepared  for  the  flight 
and  this  adversely  affects  the  pilot's  performance.  Breaking  the  taxonomy  into  25  basic 
HE  categories  allows  the  researcher  to  concentrate  on  specific  general  types  of  HE. 
Instead  of  having  to  study  289  separate  types  of  HE,  the  researcher  can  focus  on  25 
clusters  of  general  HE  causation.  This  clustering  of  HE  by  HFACS  and  its  foundation  in 
widely  accepted  theories  of  HE  allows  a  well-structured  analysis  of  human  factors  flight 
mishaps. 
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In  this  analysis  of  141  Class  A  and  B  TACAIR  human  factors  FMs,  the  design  of 
the  HFACS  taxonomy  allows  one  to  focus  on  specific  intervention  strategies.  The  key  to 
the  analysis  is  the  subset  relationships,  equations  (1)  to  (9).  The  289  types  of  HE  are 
clustered  in  17  categories  of  general  HE  types,  the  bottom  row  of  Figure  2.  To  analyze 
the  relationships  between  these  17  sets  I,  ...,Y  (Table  1),  the  matrix  of  subsets  is  studied 
(Table  4).  This  matrix  presents  an  important  relationship  in  Adverse  Mental  State  (Table 
3),  for  12  of  the  17  HE  sets  primarily  contained  in  Adverse  Mental  State.  The  next 
closest  relationship  looking  at  subsets  is  Skill  Based  Error  and  Decision  Error,  each  of 
these  substantially  encompassed  three  HE  sets.  All  other  relationships  within  the  subset 
matrix  showed  no  important  patterns. 

The  important  pattern  seen  in  the  relationships  between  Adverse  Mental  State  and 
the  1 2  other  causal  factors  definitely  stands  out  among  all  other  relationships  considered. 
Nowhere  else  in  the  data  is  such  an  important  relationship  found.  So  the  questions  arise, 
do  we  need  to  look  at  causal  factors  having  important  relationships  with  other  causal 
factors,  or  should  we  concentrate  on  the  most  frequently  occurring  singular  causal 
factors?  According  to  some  theorists,  all  that  is  required  to  prevent  an  accident  is 
intervention  at  a  single  level  or  causal  factor  and  the  FM  could  be  prevented.  This  may 
be  a  start  to  prevention  but  some  would  consider  this  theory  a  bit  simplistic  (Zotov, 
1996). 

An  FM  is  composed  of  many  HEs,  and  even  though  these  single  HEs  are  clustered 
into  common  categories  of  error,  there  is  a  great  deal  of  entanglement  between  categories. 
It  is  constructive  to  picture  the  HE  entanglement  as  a  circular  web  of  dominos  connected 
by  multiple  strands  of  a  spider's  web.  If  one  causal  factor  to  a  flight  mishap  is  removed, 
there  is  no  guarantee  that  the  chain  of  events  leading  to  the  FM  has  been  severed.  Just  as 
in  a  spider's  web,  removing  one  segment  of  the  web  doesn't  guarantee  that  the  web  has 
been  destroyed.  The  study  of  HE  is  not  an  exact  science,  and  it  is  often  clouded  by  many 
variables  in  its  study.  For  this  reason,  the  focus  cannot  be  singular,  but  one  must  try  to 
encompass  as  many  factors  as  possible.  In  attempting  to  reduce  the  FM  rate,  the  focus 
cannot  be  on  a  singular  cause  that  seems  to  stand  alone  in  the  analysis.  The  focus  needs 
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to  be  on  an  HE  type  that  appears  to  be  an  important  member  of  this  total  FM  web  (Figure 
5). 
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Figure  5.  Web  of  Important  Relationships  Surrounding  Adverse  Mental  State. 

The  important  factor  for  this  study  in  the  FM  web  is  Adverse  Mental  State,  as 
stated  previously,  12  of  the  17  bottom  HE  types  in  the  HFACS  taxonomy  have  important 
subset  relationships  within  Adverse  Mental  State.  These  12  important  factors  are:  Skill- 
Based  Errors,  Perceptual  Errors,  Adverse  Physiological  State,  Physical/Mental 
Limitations,  Crew  Resource  Management,  Personal  Readiness,  Inadequate  Supervision, 
Planned  Inappropriate  Operations,  Failed  to  Correct  Problem,  Supervisory  Violations, 
Resource  Management,  and  Organizational  Process.  As  seen  in  Figure  5,  these  HE  types 
create  an  FM  web,  where  Adverse  Mental  State  connects  to  each  factor  in  an  important 
way.  If  intervention  at  the  point  of  Adverse  Mental  Error  were  attempted,  this 
intervention  would  affect  many  other  possible  causal  factors  in  a  potential  FM.  Listed  in 


Appendix  F  is  a  detailed  description  of  the  HFACS  taxonomy,  and  it  describes  the  12 
general  types  of  HE  categories  attached  to  Adverse  Mental  State  (Figure  5). 

B.         DISCUSSION 

In  a  recent  message  released  by  the  NSC  (Aviation  Safety  Monthly  Summary  for 
Feb.  '99),  the  NSC  highlighted  NA's  current  progress  in  reducing  HE.  The  message 
looked  at  Class  A  FMs  for  all  NA  aircraft  between  fiscal  years  (FY)  90  and  FY98,  a  total 
of  212  FMs.  Analyzing  the  findings  of  the  NSC's  message  gives  a  comparison  with  this 
current  study  of  Naval  TACAIR  Class  A  and  B  FMs  from  FY90  to  FY97.  This  gives  a 
comparison  of  how  the  TACAIR  community  is  doing  compared  with  the  NSC's 
impression  of  the  NA  fleet  as  a  whole.  To  recap  the  thesis,  it  covered  all  Naval  TACAIR 
Class  A  and  B  FMs  from  FY90  to  FY97,  and  FY98  is  used  to  validate  the  simulation 
model  used  in  the  study.  Of  the  total  212  Class  A  FMs  evaluated  in  the  NSC's  message, 
this  thesis  looks  at  134  of  these  FMs  (63  percent)  and  an  additional  19  Class  B  FMs  are 
included  for  FY90  to  FY98. 

The  following  discussion  contrasts  the  three  main  points  presented  in  the  NSC 
message  with  the  findings  of  this  thesis.  To  begin,  let  us  first  review  the  NSC's  points: 

1)  For  all  Class  A  Naval  Aircraft  FMs  from  FY90  to  FY98  a  downward  trend  in 
the  FM  rate  exists. 

2)  A  strong  correlation  between  leadership  and  the  reduction  of  violations 
exists. 

3)  In  FY98,  "Skill-Based  Errors"  emerged  unchecked  and  the  current  trend 
shows  that  this  type  of  HE  will  be  involved  in  an  excess  of  65  percent  of  future 
FMs. 

The  above  statements  regarding  Naval  Aviation  in  general  from  FY90  to  FY98  are 
insightful  points  of  contrast  to  compare  this  analysis  of  Naval  Aviation  TACAIR.  Take 
the  first  point  concerning  the  downward  trend  in  Naval  Aviation's  FM  rate  from  FY90  to 
FY98.  An  initial  observation  of  the  TACAIR  data  and  NA  in  general  is  that  discerning  a 
downward  trend  in  the  Naval  Aviation  FM  rate  is  difficult.  The  reason  for  this  is  that  the 
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accident  arrival  rate  is  assumed  to  be  best  modeled  by  a  Poisson  arrival  process,  and  it  is 
difficult  to  determine  a  trend  when  moving  from  one  year  to  the  next.  This  is  especially 
true  when  the  arrival  rate  does  not  deviate  far  from  the  mean  of  the  assumed  distribution. 

In  a  Poisson  arrival  process,  the  number  of  FMs  are  expected  to  fluctuate  above 
and  below  the  mean,  so  care  must  be  taken  when  trying  to  identify  trends.  We  must  be 
careful  when  stating  that  a  downward  trend  exists  because  of  the  randomness  found  in  the 
occurrence  of  human  error.  The  actual  FY98  FM  rate  for  Naval  TACAIR  is  one  accident 
below  the  expected  eight-year  average  arrival  rate  of  the  simulation  run.  Therefore,  it 
cannot  be  concluded  that  there  has  been  a  statistically  significant  change  in  the  true  flight 
mishap  rate  (Figure  4).  Looking  at  the  data  for  FY90  to  FY98,  neither  can  it  be 
concluded  that  there  is  a  downward  trend  in  the  FM  rate  for  the  Naval  TACAIR 
community  during  this  period. 

The  second  issue  to  contrast  is  the  reduction  in  violations  due  to  better  leadership 
and  supervision  in  the  NA  community.  Looking  at  the  Naval  TACAIR  community's 
human  error  FMs  from  FY90  to  FY97,  refer  to  the  correlation  matrices  (Appendix  C)  to 
find  that  the  correlation  between  Unsafe  Supervision  (C)  and  Violations  (F)  is  -0.076. 
This  correlation  suggests  that  in  Naval  TACAIR  there  is  no  positive  relationship  between 
the  findings  of  "Unsafe  Supervision  and  Violations"  in  the  TACAIR  human  factors  FMs 
studied.  If  "Unsafe  Supervision"  is  cited  in  an  accident,  then  the  chance  that  "Violation" 
is  cited  in  the  accident  does  not  increase  and  vice  versa.  Therefore,  during  the  period 
FY90  to  FY97,  there  was  no  significant  positive  relationship  between  "Unsafe 
Supervision  and  Violations"  in  the  Naval  TACAIR  community.  Any  finding  regarding 
this  relationship  during  the  period  FY90  to  FY97  would  have  to  be  drawn  from  sources 
other  than  the  HFACS  categorization  of  HE  that  are  based  on  the  MIRs. 

The  third  point  to  contrast  is  the  rise  of  "Skill-Based  Error"  in  NA.  To  look  at 
this  problem  in  Naval  TACAIR,  a  spreadsheet  is  constructed  with  the  following 
attributes:  25  columns  each  containing  a  causal  factor  in  the  HFACS  taxonomy  and  9 
rows  for  FY90  to  FY98.  The  data  for  FY98  is  sparse  because  not  all  FMs  have  been 
closed  out  and  released  for  analysis.  Each  cell  contains  the  total  number  of  accidents  that 
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cited  a  specific  causal  factor  for  that  fiscal  year.  The  cells  were  then  divided  by  the  total 
TACAIR  flight  hours  for  that  fiscal  year  and  multiplied  by  100,000  (Appendix  D).  This 
allows  all  cells  to  be  compared  on  the  same  scale,  the  number  of  causal  factors/ 100,000 
flight  hours.  Upon  inspecting  the  "Skill-Based  Error"  rates  from  FY90  to  FY98,  no 
important  fluctuations  are  found.  Looking  at  Figure  6,  a  histogram  of  the  FY98 
simulation  run  results  for  "Skill-Based  Error,"  if  all  twelve  accidents  considered  in  this 
study  for  FY98  should  cite  "Skill-Based  Error"  as  a  causal  factor  in  the  FM.  Nothing  can 
be  concluded  about  this  event  being  statistically  significant  because  the  twelve  accidents 
are  contained  in  the  95  percent  CI  for  the  "Skill-Based  Error"  distribution,  calculated 
using  the  simulation. 


HISTOGRAM  1000  Iterations 


Figure  6.    Poisson  distribution  of  "Skill-Based  Errors",  based  on  408,500  flight  hours, 
using  simulation  model  n=141. 
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C.         RECOMMENDATIONS 

The  Naval  TACAIR  communities  flight  mishap  rate  has  remained  fairly  constant 
from  FY90  to  FY97  and  given  the  assumption  of  a  Poisson  arrival  rate  for  FMs,  the  FY98 
FM  rate  has  been  well  modeled.  The  actual  accident  rate  in  FY98  is  12  TACAIR  flight 
mishaps  that  are  attributable  to  HE  and  the  model  predicts  13  FMs  due  to  HE  for  FY98. 
The  models  95  percent  confidence  interval  (CI)  for  the  FY98  expected  accident  rate  is 
(6,21),  the  actual  FM  rate  of  12  is  well  contained  in  the  95  percent  CI.  The  conclusion 
from  the  model's  result  is  that  there  has  been  no  significant  change  in  Naval  TACAIR's 
human  factors  FM  rate  in  FY98  when  compared  to  the  long-term  FM  rate  from  FY90  to 
FY97. 

Looking  at  the  results  from  the  simulation  (Appendix  B),  there  are  five  significant 
singular  causal  factors:  "Adverse  Mental  State,  Skill-Based  Errors,  Decision  Errors,  Crew 
Resource  Management  and  Organizational  Process."  These  five  causal  factors  all  had  the 
highest  probability  of  occurrence  when  compared  with  other  causal  factors.  Looking  at 
combinations  of  causal  factors  (Appendix  B)  only  two  significant  combinations, 
'"Adverse  Mental  State  and  Skill-Based  Errors"  and  "Adverse  Mental  State  and  Crew 
Resource  Management"  exist.  There  are  two  recommendations  for  intervention  that  are 
discussed  in  the  following  paragraphs,  each  from  a  different  point  of  view  for  HE 
intervention. 

If  the  viewpoint  of  removing  a  single  causal  factor  (the  Domino  theory)  is  the 
basis  of  the  recommendation,  then  there  would  be  five  points  of  intervention:  "Adverse 
Mental  State,  Skill-Based  Errors,  Decision  Errors,  and  Organizational  Process."  In  the 
case  of  "Crew  Resource  Management,"  the  NSC  has  already  developed  a  program  for  NA 
to  increase  the  awareness  of  "Crew  Resource  Managements"  importance  in  NA.  Taking 
the  other  four  causal  factors,  the  expected  mean  value  for  accidents/ 100,000  flight  hours 
are  listed  in  Table  9  along  with  a  50  percent  intervention  FM  reduction  for  discussion. 
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Table  9.  Mean  accidents/ 100,000  flight  hours  predicted  in  simulation  for  significant 
single  causal  factors.  Example:  it  is  predicted  that  2.179  FMs/100,000  flight  hours  will 
cite  Adverse  Mental  State  as  a  causal  factor. 


Mean/ 100.000  flight  hours 

50%  reduction 

Adverse  Mental  State 

2.179 

1.090 

Skill-Based  Error 

1.950 

0.975 

Decision  Error 

1.768 

0.884 

Organizational  Process 

0.997 

0.499 

Looking  at  Adverse  Mental  State  in  Table  9,  as  an  example,  the  Navy  should 
develop  a  program  to  intervene  and  educate  aviators  to  the  hazards  of  Adverse  Mental 
State.  If  the  program  were  50  percent  successful  in  intervention,  the  expected  reduction 
in  accidents  would  be  1.090  FMs/1 00,000  flight  hours.  Using  the  TACAIR  flight  hours 
for  FY98,  the  expected  reduction  in  FMs  would  be  4.453  FMs.  At  an  average  cost  of  $22 
million  per  FM  for  FY98  (Gaynor,  1999),  that  would  be  an  approximate  $98  million 
savings  for  that  fiscal  year. 

An  observation  can  be  made  concerning  single  point  intervention  using  the  current 
"Crew  Resource  Management"  program  effect  on  FMs.  By  FY94,  the  Navy  had 
established  a  program  to  increase  awareness  of  "Crew  Resource  Management''  and  had 
widely  disseminated  the  program  to  all  Naval  squadrons  to  implement  in  their  safety 
training  programs.  Taking  the  HFACS  data  and  looking  at  the  rates  of  "Crew  Resource 
Management"  from  FY94  to  FY97  (Figure  7),  there  has  not  been  a  significant  decline  in 
the  rate  of  "Crew  Resource  Management."  Looking  at  the  accident  data  for  FY98,  one 
sees  that  the  data  is  incomplete,  and  does  not  contain  a  full  account  of  causal  factors  for 
the  12  FMs  during  FY98.  The  current  (though  incomplete)  "Crew  Resource 
Management"  arrival  rate  of  1.23  FMs/ 100,000  flight  hours  is  not  significantly  below  the 
"Crew  Resource  Management"  average  of  1.412  FMs/100,000  flight  hours  from  FY94  to 
FY97.  In  five  years  of  intervention,  no  significant  change  in  the  rate  of  "Crew  Resource 
Management"  being  cited  as  a  causal  factor  in  Naval  TACAIR  FMs  has  occurred. 

The  second  viewpoint  of  intervention  is  that  it  is  not  sufficient  at  a  single  point, 
for  HE  needs  to  be  considered  as  a  complex  web  of  interwoven  causal  factors  (Figure  5). 
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The  results  of  the  analysis  for  the  HFACS  causal  factors  in  TACAIR  FMs  from  FY90  to 
FY97  highlight  one  significant  causal  factor,  "Adverse  Mental  State."  Taking  the  two 
statistically  significant  combinations  of  causal  factors,  the  mean  accidents/ 100,000  flight 
hours  are  listed  in  Table  10  along  with  a  50  percent  intervention  result.  Consider  the 
combination  of  "Adverse  Mental  State  and  Skill-Based  Error"  in  Table  10.  As  an 
example,  the  Navy  must  develop  a  program  to  intervene  at  both  these  levels  in 
combination.  If  the  program  is  50  percent  successful,  the  expected  reduction  in  accidents 
would  be  0.727  FMs/ 100,000  flight  hours.  Using  the  TACAIR  flight  hours  for  FY98,  the 
expected  reduction  would  be  2.97  FMs.  At  an  average  cost  of  $22  million  per  FM  for 
FY98  (Gaynor,  1999),  that  would  be  an  approximate  $65  million  savings  for  that  fiscal 
year. 

FY90  to  FY98  Class  A  and  B  TACAIR  CRM  Error  Rate/100,000  Flight  Hours 


3  CO 

1.58 

1  59 

1  66 

1.00 

1.15 

1.25 

1.23 

0.50- 

Figure  7.  Crew  Resource  Management  (CRM)  arrival  rate  per  100,000  flight  hours  for 
FY90  to  FY98.  FY98  has  incomplete  data  due  to  some  MIRs  not  being  fully  completed 
for  the  year.  Example:  for  FY94  CRM,  HEs  occurred  in  1.15  FMs/100.000  flight  hours. 
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Table  10.    Mean  accidents/ 100.000  flight  hours  predicted  in  simulation  for  significant 
combinations  of  causal  factors. 


Adverse  Mental  State/Skill-Based  Error 
Adverse  Mental  State/CRM 


Mean/1 00.000  flight  hours      50%  reduction 


1.453 
1.101 


0.727 
0.550 


In  reality,  due  to  the  complexity  and  interactions  among  different  types  of  HE, 
predicting  the  reduction  of  HE  is  quite  difficult.  This  complexity  therefore  should  point 
to  the  development  of  a  program  that  is  as  encompassing  as  possible.  The  program 
should  cover  many  aspects  of  HE,  while  keeping  the  size  of  the  program  moderate  and 
economical.  The  development  time,  maintenance  requirements  of  the  program  and  the 
time  required  to  train  aviators  in  the  new  program  should  be  reasonable.  The  program 
should  be  a  one-  to  two-hour  program,  providing  annual  or  semi-annual  presentations  to 
aviators  so  they  can  maintain  awareness  of  the  program  issues.  Given  the  strong 
relationships  exhibited  by  Adverse  Mental  State  with  the  majority  of  the  other  causal 
factors  in  the  HFACS  taxonomy,  focusing  on  an  FM  awareness  program  for  Adverse 
Mental  State  would  be  a  proper  choice.  Since  Adverse  Mental  State  is  intertwined  with 
so  many  other  causal  factors,  intervention  at  Adverse  Mental  State  would  be  expected  to 
have  the  best  chance  of  reducing  FMs  because  of  Adverse  Mental  State's  important 
entanglements  with  multiple  causal  factors.  This  entangled  relationship  would  give  a  FM 
reduction  program  that  focused  on  Adverse  Mental  State  the  best  chance  of  completely 
breaking  the  chain  of  events  leading  to  a  FM.  Compared  with  an  intervention  program 
that  focus's  on  a  significant  single  causal  factor,  not  having  this  entangled  relationship 
with  other  causal  factors,  intervention  at  Adverse  Mental  State  would  be  the  obvious  HE 
choice  on  which  to  focus  in  the  development  of  a  program  to  reduce  human  error  FMs  in 
Naval  Aviation  TACAIR. 
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APPENDIX  A.  CORRELATION  MATRICES  FOR  MATRICES  HFACSA, 
HFACSB,  AND  HFACSC 

Correlation  for  data  in:  HFACSA 
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Correlation  for  data  in:  HFACSC 
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APPENDIX  B.  S-PLUS  SIMULATION  CODE 


hfacsprcgram2  <- 

function (mtrix, catvector, lambda, time, iterations, mishaps)  { 

counter  <-  rep ( 0 , iterations) 
poisscn  <-  rep ( 0 , iterations) 
counter. data  <-  C 

fcr  (i  in  1 : iterations)  { 

=  ger.era:s  number  of  accidents  E( count  accidents)  =  lambda* time 

randompoisson  <-  rpois (1, lambda* time) 

poisson[i]  <-  randompoisson 

^generate  random  uniform  selection  of  actual  HFACS  accident 

randorcunif orm  <-  round (runif (randompoisson,  1 , mishaps ) ) 

#generate  matrix  of  randomly  selected  accidents 

ace. data  <-  mtrix [randomuni form, ] 

ace. matrix  <-  as .matrix (ace . data) 

solution. data  <-  catvector%*%t (ace .macrix) 

count. data  <-  simfsolution . data  ==  sum ( catvector ) ) 

counter [i]  <-  count. data 
} 
print (mean (counter) ) 
print (quantile (poisson, .025) ) 
prir.r  (quantile  (poisson,  .  975)  ) 
print (quantile (counter, .025) ) 
print (quantile (counter, . 975) ) 
data. frame (poisson, counter) 
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APPENDIX  C.  MEAN  AND  95  PERCENT  CI  FOR  SIMULATION  RUNS 
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APPENDIX  D.  CAUSAL  FACTOR  RATE/100,000  FLIGHT  HOURS 
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APPENDIX  E.  KEY  TO  HFACS  CODING  A, ...  ,Y 


Coding 

HFACS  Causal  Factor 

A 

Unsafe  Acts 

B 

Preconditions  for  Unsafe  Acts 

C 

Unsafe  Supervision 

D 

Organizational  Influence 

E 

Errors 

F 

Violations 

G 

Substandard  Conditions  of  Operators 

H 

Substandard  Practices  of  Operators 

I 

Skill-Based  Errors 

J 

Decision  Errors 

K 

Perceptual  Errors 

L 

Infraction 

M 

Exceptional 

N 

Adverse  Physiological  State 

0 

Adverse  Mental  State 

P 

Physical/Mental  Limitation 

Q 

Crew  Resource  Management  (CRM) 

R 

Personal  Readiness 

S 

Inadequate  Supervision 

T 

Planned  Inappropriate  Operations 

U 

Failed  to  Correct  Problem 

V 

Supervisory  Violations 

w 

Resource  Management 

X 

Organizational  Climate 

Y 

Organizational  Process 
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APPENDIX  F.  EXCERPT  FROM  OPNAV  3750.6R  (APPENDIX  O)  HFACS 
TAXONOMY 

Human  Factors  Analysis  and  Classification  System  (HFACS) 

Drawing  upon  Reason's  (1990)  concept  of  latent  and  active  failures,  a  framework 
was  developed  to  identify  the  "holes"  called  the  Human  Factors  Analysis  and 
Classification  System  (HFACS).  HFACS  describes  four  levels  of  failure:  1)  Unsafe  Acts, 
2)  Preconditions  for  Unsafe  Acts,  3)  Unsafe  Supervision,  and  4)  Organizational 
Influences.  A  brief  description  of  the  major  components  and  causal  categories  follows, 
beginning  with  the  level  most  closely  tied  to  the  accident,  unsafe  acts. 

1.  Unsafe  Acts 

The  unsafe  acts  committed  by  aircrew  generally  take  on  two  forms,  errors  and 
violations.  The  first,  errors,  are  not  surprising  given  the  fact  that  human  beings  by  their 
very  nature  make  errors.  Consequently,  aircrew  errors  are  seen  in  most  FMs  -  often  as 
that  last  fatal  flaw  before  a  FM  occurs.  Violations,  on  the  other  hand,  represent  the 
willful  disregard  for  the  rules  and  typically  occur  less  frequently.  Still,  not  all  errors  are 
alike.  Likewise,  there  are  different  types  of  violations.  As  such,  the  unsafe  acts  aircrew 
commit  can  be  classified  among  three  basic  error  types  (skill-based,  decision,  and 
perceptual)  and  two  forms  of  violations  (infractions  and  exceptional).  Each  will  be 
described  in  turn  (Figure  2). 

Using  this  simple  classification  scheme,  the  investigator  must  first  decide  if  an 
unsafe  act  (active  failure)  was  committed  by  the  operator  (aircrew,  maintainer,  etc.).  If 
so,  the  investigator  must  then  decide  if  an  error  occurred  or  a  rule  was  willfully  violated. 
Once  this  is  done,  the  investigator  can  further  define  the  causal  factor  as  a  specific  type  of 
error  or  violation  as  described  below. 

Error 

Skill-based  Errors.  Skill-based  behavior  is  best  described  as  those  "stick-and- 
rudder"  and  other  basic  flight  skills  that  occur  without  significant  conscious  thought.  As 
a  result,  skill-based  actions  are  particularly  vulnerable  to  failures  of  attention  and/or 
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memory.  In  fact,  attention  failures  have  been  linked  to  many  skill-based  errors  such  as 
the  breakdown  in  visual  scan  patterns,  task  fixation,  the  inadvertent  activation  of  controls, 
and  the  misordering  of  steps  in  a  procedure,  among  others  (Table  1).  Consider,  for 
example,  the  pilot  so  intent  on  putting  bombs  on  target  that  he  disregards  his  low  altitude 
warning  only  to  collide  with  the  ground.  Closer  to  home,  have  you  ever  locked  yourself 
out  of  your  car  or  missed  your  exit  because  your  were  either  distracted,  in  a  hurry,  or 
daydreaming?  These  are  all  examples  of  attention  failures  that  occur  during  highly 
automatized  behavior.  While  on  the  ground  they  may  be  frustrating,  in  the  air  they  can 
become  catastrophic. 

In  contrast  to  attention  failures,  memory  failures  often  appear  as  omitted  items  in 
a  checklist,  place  losing,  or  forgotten  intentions.  For  example,  most  of  us  have 
experienced  going  to  the  refrigerator  only  to  forget  what  we  came  for.  Likewise,  it  is  not 
difficult  to  imagine  that  in  emergency  situations,  when  under  stress,  steps  in  boldface 
emergency  procedures  or  radio  calls  can  be  missed.  Even  when  not  particularly  stressed 
however,  individuals  have  forgotten  to  set  the  flaps  on  approach  or  lower  the  landing 
gear. 

Skill-based  errors  can  happen  even  when  no  apparent  attention  of  memory  failure 
is  present.  The  individual  flying  skill/techniques  of  Naval  aviators  differ  from  one  pilot 
to  the  next.  We  have  all  known  individuals  that  fly  smooth  and  effortless  and  those  who 
make  every  mission  an  adventure.  It  is  the  skill-based  errors  of  the  latter  that  often  leads 
to  FMs  as  well.  The  bottom  line  is  that  skill-based  errors  are  unintended  behaviors.  That 
is,  individuals  typically  do  not  choose  to  limit  their  scan  patterns,  forget  a  boldface 
procedure,  or  fly  poorly  -  it  just  happens,  unbeknownst  to  the  individual. 

Decision  Errors.  The  second  error  form,  decision  errors,  represent  intentional 
behavior  that  proceeds  as  intended,  yet  the  plan  proves  inadequate  or  inappropriate  for  the 
situation.  Often  referred  to  as  "honest  mistakes",  these  unsafe  acts  represent  the  actions 
or  inaction  of  individuals  whose  heart  is  in  the  right  place,  but  they  either  did  not  have  the 
appropriate  knowledge  available  or  just  simply  chose  poorly.  Regardless  of  the  outcome, 
the  individual  made  a  conscious  decision. 
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Decision  errors  come  in  many  forms,  and  occur  for  a  variety  of  reasons. 
However,  they  typically  represent  poor  decisions,  improper  procedural  execution,  or  the 
misinterpretation  or  misuse  of  relevant  information  (Table  1).  The  bottom  line  is  that  for 
good  or  bad  the  individual  made  a  conscious  choice  and  elected  to  do  what  was  done  in 
the  cockpit  -  unfortunately,  in  the  case  of  FMs,  it  did  not  work. 

Perceptual  Errors.  Not  surprisingly,  when  your  perception  of  the  world  is 
different  then  reality,  errors  can,  and  often  do,  occur.  Typically,  perceptual  errors  occur 
when  sensory  input  is  degraded  or  'unusual',  as  is  the  case  when  visual  illusions  or  spatial 
disorientation  occurs  (Table  1).  Visual  illusions  occur  when  the  brain  tries  to  'fill  in  the 
gaps'  with  what  it  feels  belongs  in  a  visually  impoverished  environment,  like  that  seen  at 
night  or  in  the  weather.  Likewise,  spatial  disorientation  occurs  when  the  vestibular 
system  cannot  resolve  your  orientation  in  space  and  therefore  makes  a  "best  guess"  - 
typically  when  visual  (horizon)  cues  are  absent  at  night  or  in  weather.  In  either  event,  the 
individual  is  left  to  make  a  decision  based  on  faulty  information  leading  to  and  error,  and 
often  a  FM.  Likewise,  it  is  often  quite  difficult  to  judge  precise  distance  and  closure 
between  aircraft  and  the  ground  when  relative  cues  like  clouds  or  terrain  features  are 
absent.  Consequently,  aircrews  are  left  to  make  control  inputs  based  upon  misperceived 
or  absent  information.  Tragically,  these  sorts  of  errors  often  lead  to  midair  collisions  or 
controlled  flight  into  terrain. 

Violations 

Routine/Infractions.  Violations  in  general  are  the  willful  departure  from  authority 
that  simply  cannot  be  tolerated.  We  have  identified  two  distinct  types  of  violations 
(Table  1).  The  first,  infractions,  tend  to  be  routine/habitual  by  nature  constituting  a  part 
of  the  individual's  behavioral  repertoire.  For  example,  the  individual  that  drives 
consistently  5-10  mph  faster  than  allowed  by  law.  While  certainly  against  the  law,  many 
folks  do  it.  Furthermore,  if  you  go  64  in  a  55  mph  zone,  you  always  drive  64  in  a  55  mph 
zone.  That  is,  you  'routinely'  violate  the  law.  Commonly  referred  to  as  "bending"  the 
rules,  these  violations  are  often  tolerated  and,  in  effect,  sanctioned  by  supervisory 
authority  (that 
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Table  1.  Selected  examples  of  Unsafe  Acts  of  Operators  (Note:  this  is  not  a  complete  listing) 

Unsafe  Acts  of  Operators 

Errors 

Violations 

Skill-based  Errors 

Routine  (Infractions) 

Breakdown  in  Visual  Scan 

Failed  to  Adhere  to  Brief 

Delayed  Response 

Violation  of  Naval  NATOPS/Regulations/SOP 

Failed  to  Prioritize  Attention 

-  Failed  to  use  RAD  ALT 

Failed  to  Recognize  Extremis 

-  Flew  an  unauthorized  approach 

Improper  Instrument  Cross-Check 

-  Failed  to  execute  appropriate  rendezvous 

Inadvertent  use  of  Flight  Controls 

-  Violated  training  rules 

Omitted  Step  in  Procedure 

-  Failed  to  adhere  to  departure  procedures 

Omitted  Checklist  Item 

-  Flew  overaggressive  maneuver 

Poor  Technique 

-  Failed  to  properly  prepare  for  flight 

-  Failed  to  comply  with  NVG  SOP 

Decision  Errors 

Improper  Takeoff 

Exceptional 

Improper  Approach/Landing 

Briefed  Unauthorized  Flight 

Improper  Procedure 

Not  Current/Qualified  for  Mission 

Misdiagnosed  Emergency 

Intentionally  Exceeded  the  Limits  of  the  Aircraft 

Wrong  Response  to  Emergency 

Violation  of  Naval  NATOPS/Regulations/SOP 

Exceeded  Ability 

-  Continued  low-altitude  flight  in  VMC 

Inappropriate  Maneuver 

-  Failed  to  ensure  compliance  with  rules 

Poor  Decision 

-  Unauthorized  low-altitude  canyon  running 

-  Not  current  for  mission 

Perceptual  Errors 

-  Flathatting  on  takeoff 

Misjudged  Distance/ Altitude/ Airspeed 

-  Briefed  and  flew  unauthorized  maneuver 

Spatial  Disorientation 

Visual  Illusion 

is,  you  are  not  likely  to  get  a  ticket  going  64  in  a  55).  If  however,  the  local  authorities 
started  handing  out  tickets  for  exceeding  the  speed  limit  on  the  highway  by  9  mph  (like  is 
often  done  on  military  installations)  then  it  is  less  likely  that  individuals  would  violate  the 
rules.  Therefore,  by  definition,  if  a  routine  violation/infraction  is  identified,  one  must 
look  further  up  the  supervisory  chain  to  identify  those  that  are  condoning  those  violations. 
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Exceptional.  Unlike  routine  violations,  exceptional  violations  appear  as  isolated 
departures  from  authority,  not  necessarily  indicative  of  an  individual's  typical  behavior 
pattern  nor  condoned  by  management.  For  example,  an  isolated  instance  of  driving  105 
mph  in  a  55  mph  zone,  or  in  Naval  Aviation,  flathatting,  is  considered  an  exceptional 
violation.  It  is  important  to  note  that  while  most  exceptional  violations  are  heinous,  they 
are  not  considered  'exceptional'  because  of  their  extreme  nature.  Rather,  they  are 
considered  exceptional  because  they  are  neither  typical  of  the  individual  nor  condoned  by 
authority. 

2.  Preconditions  for  Unsafe  Acts 

Arguably,  the  unsafe  acts  of  operators  can  be  directly  linked  to  nearly  80  percent 
of  all  Naval  Aviation  FMs.  However,  simply  focusing  on  unsafe  acts  is  like  focusing  on 
a  fever  without  understanding  the  underlying  disease  causing  it.  As  such,  investigators 
must  dig  deeper  into  why  the  unsafe  acts  took  place.  As  a  first  step,  we  describe  two 
major  subdivisions  of  unsafe  aircrew  conditions,  each  with  their  specific  causal 
categories.  Specifically,  they  include  the  Substandard  Conditions  of  operators  (i.e., 
Adverse  Mental  States,  Adverse  Physiological  States,  and  Physical/Mental  Limitations) 
as  well  as  those  Substandard  Practices  they  commit.  Each  are  described  briefly  below. 

Substandard  Conditions  of  Operators 

Adverse  Mental  States.  Being  prepared  mentally  is  critical  in  nearly  every 
endeavor,  perhaps  more  so  in  aviation.  As  such,  the  category  of  adverse  mental  states 
was  created  to  account  for  those  mental  conditions  that  affect  performance  (Table  2). 
Principle  among  these  is  the  loss  of  situational  awareness,  task  fixation,  distraction,  and 
mental  fatigue  due  to  sleep  loss  or  other  stressors.  Also  included  in  this  category  are 
personality  traits  and  pernicious  attitudes  such  as  overconfidence,  complacency,  and 
misplaced  motivation.  For  example,  if  an  individual  is  mentally  tired  for  whatever 
reason,  the  likelihood  that  an  error  would  occur  increases.  Likewise,  overconfidence, 
arrogance,  and  other  pernicious  attitudes  will  influence  the  likelihood  that  a  violation  is 
committed.  While  errors  and  violations  are  important  causal  factors,  adverse  mental 
states  such  as  these  are  no  less  important,  perhaps  even  more  so,  in  the  causal  sequence. 
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Adverse  Physiological  States.  The  second  category,  adverse  physiological  states, 
refers  to  those  medical  or  physiological  conditions  that  preclude  safe  operations  (Table 
2).  Particularly  important  to  Naval  Aviation  are  conditions  such  as  spatial  disorientation, 
visual  illusions,  G-induced  loss  of  consciousness  (G-LOC),  hypoxia,  physical  fatigue,  and 
the  myriad  of  pharmacological  and  medical  abnormalities  known  to  affect  performance. 
If,  for  example,  an  individual  were  suffering  from  an  inner  ear  infection,  the  likelihood  of 
spatial  disorientation  occurring  when  entering  IMC  goes  up  markedly.  Consequently,  the 
medical  condition  must  be  addressed  within  the  causal  chain  of  events. 

Physical/Mental  Limitations.  The  third,  and  final,  category  of  Aeromedical 
Conditions,  Physical/Mental  Limitations,  refers  to  those  instances  when  the  mission 
requirements  exceed  the  capabilities  of  the  individual  at  the  controls.  Physical/Mental 
Limitations  can  take  many  forms  (Table  2).  For  example,  at  night  our  visual  systems  are 
limited  by  the  capability  of  the  photosensors  in  our  eyes  and  hence  vision  is  severely 
degraded.  Yet,  like  driving  a  car,  we  do  not  necessarily  slow  down  or  take  additional 
precautions.  In  aviation,  this  often  results  in  not  seeing  other  aircraft,  obstacles,  or  power 
lines  due  to  the  size  or  contrast  of  the  object  in  the  visual  field.  Similarly,  there  are 
occasions  when  the  time  required  to  complete  a  task  or  maneuver  exceeds  human 
capacity.  It  is  well  documented  that  if  individuals  are  required  to  respond  quickly  (i.e., 
less  time  is  available  to  consider  all  the  possibilities  or  choices  thoroughly),  the 
probability  of  making  an  error  goes  up  markedly. 

There  are  two  additional  instances  of  physical/mental  limitations  that  need  to  be 
addressed;  albeit  they  are  often  overlooked  in  most  FM  investigations.  They  involve 
individuals  who  simply  are  not  compatible  with  aviation.  For  example,  some  individuals 
simply  do  not  have  the  physical  strength  to  operate  in  high-G  environments  or  for 
anthropometric  reasons  simply  have  difficulty  reaching  the  controls.  In  other  words, 
cockpits  have  traditionally  not  been  designed  with  all  shapes,  sizes,  and  physical  abilities 
in  mind.  Likewise,  not  everyone  has  the  mental  ability  or  aptitude  for  flying  Naval 
aircraft.  Just  as  not  all  of  us  can  be  concert  pianists  or  NFL  linebackers,  we  cannot  all  fly 
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Naval  aircraft.  The  hard  part  is  identifying  whether  this  might  of  played  a  role  in  the  FM 
causal  sequence. 

Substandard  Practices  of  Operators 

Crew  Resource  Mismanagement.  To  account  for  occurrences  of  poor 
coordination  among  aircrew  and  other  personnel  associated  with  the  safe  conduct  of  the 
flight,  the  category  of  crew  resource  management  was  created  (Table  2).  This  includes 
coordination  both  within  and  between  aircraft,  ATC,  and  maintenance  control,  as  well  as 
facility  and  other  support  personnel.  Anywhere  communication  between  individuals  is 
required,  the  potential  for  miscommunication,  or  simply  poor  resource  management, 
exists.  However,  aircrew  coordination  does  not  stop  with  the  aircrew  in  flight.  It  also 
includes  coordination  before  and  after  the  flight  with  the  brief  and  debrief  of  the  aircrew. 
Literally  volumes  have  been  written  on  the  topic,  yet  it  continues  to  permeate  both  fixed- 
wing  and  rotary-wing  aviation,  as  well  as  multi-crew  and  single-seat  aircraft.  The 
conscientious  investigator  must  always  be  aware  of  the  potential  for  poor  CRM  practices. 

Personal  Readiness.  In  aviation,  or  for  that  matter  in  any  occupational  setting, 
individuals  are  expected  to  show  up  for  work  ready  to  perform  at  optimal  levels.  For 
Naval  Aviation  however,  personal  readiness  failures  occur  when  individuals  fail  to 
prepare  physically  or  mentally  for  flight.  For  instance,  violations  of  crew  rest 
requirements,  bottle-to-brief  rules,  and  self-medicating  all  will  affect  performance  in  the 
aircraft.  It  is  not  hard  to  imagine  that  when  you  violate  crew  rest  requirements,  you  run 
the  risk  of  mental  fatigue  and  other  adverse  mental  states.  (Note  that  violations  that  effect 
personal 
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Table  2.  Selected  examples  of  Unsafe  Aircrew  Conditions  (Note:  this  is  not  a  complete 

listing) 

Preconditions  for  Unsafe  Acts 

Aeromedical 

Crew  Resource  Management 

Adverse  Mental  States 

Failed  to  Back-up 

Channelized  Attention 

Failed  to  Communicate/Coordinate 

Complacency 

Failed  to  Conduct  Adequate  Brief 

Distracted 

Failed  to  Use  All  Available  Resources 

Mental  Fatigue 

Failure  of  Leadership 

Get-home-it  is 

Misinterpretation  of  Traffic  Calls 

Haste 

Trans-cockpit  Authority  Gradient 

Life  Stress 

Loss  of  Situational  Awareness 

Personal  Readiness 

Misplaced  Motivation 

Excessive  Physical  Training 

Task  Saturation 

Self-Medicating 

Violation  of  Crew  Rest  Requirement 

Adverse  Phvsioloeical  States 

Violation  of  Bottle-to-Brief  Requirement 

G-Induced  Loss  of  Consciousness 

Impaired  Physiological  State 

Medical  Illness 

Physiological  Incapacitation 

Physical  Fatigue 

Phvsical/Mental  Limitation 

Insufficient  Reaction  Time 

Visual  Limitation 

Incompatible  Intelligence/ Aptitude 

Incompatible  Physical  Capability 

readiness  are  not  considered  "unsafe  act,  violation"  since  they  typically  do  not  happen  in 
the  cockpit,  nor  are  they  active  failures  with  direct  and  immediate  consequences) 

Still,  not  all  personal  readiness  failures  occur  as  a  result  of  violations  of  rules.  For 
example,  running  10  miles  before  piloting  an  aircraft  may  not  be  against  any  existing 
regulations,  yet  it  may  impair  the  physical  and  mental  capabilities  of  the  individual 
enough  to  degrade  performance  and  elicit  unsafe  acts.  Likewise,  the  traditional  "candy 
bar  and  coke"  lunch  of  the  naval  aviator  may  sound  good  but  may  not  be  sufficient  to 
sustain  performance  in  the  rigorous  environment  of  military  aviation.  Even  cramming  for 
exams  may  significantly  impair  your  sleep  and  may  in  some  cases  influence  your 
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performance  the  next  day  in  the  cockpit.  While,  there  may  be  no  rules  governing  such 
behavior,  aircrew  must  be  their  own  best  judge.  Certainly,  additional  education  and 
physical  exercise  is  a  good  thing  when  taken  in  moderation,  but  aircrew  must  always 
assess  their  condition  objectively  before  manning  the  aircraft. 

3.  Unsafe  Supervision 

It  is  the  experience  of  the  NSC  that  often  the  FM  causal  chain  of  events  can  be 
traced  back  up  the  supervisory  chain  of  command.  As  such,  we  have  identified  four 
categories  of  Unsafe  Supervision:  Inadequate  Supervision,  Planned  Inappropriate 
Operations,  Failed  to  Correct  a  Known  Problem,  and  Supervisory  Violations.  Each  are 
described  briefly  below. 

Inadequate  Supervision.  The  role  of  any  supervisor  is  to  provide  the  opportunity 
to  succeed.  To  do  this  the  supervisor,  no  matter  what  level  he  operates  at,  must  provide 
guidance,  training  opportunities,  leadership,  motivation,  and  the  proper  role  model. 
Unfortunately,  this  is  not  always  the  case.  It  is  not  difficult  to  conceive  of  a  situation 
where  adequate  crew  resource  management  training  was  either  not  provided,  or  the 
opportunity  to  attend  was  not  afforded,  to  a  particular  aircrew  member.  Conceivably,  his 
aircrew  coordination  skills  would  be  compromised  and  if  put  into  an  adverse  situation  (an 
emergency  for  instance),  he  would  be  at  risk  for  errors  and  potentially  a  FM.  Therefore, 
the  category  Inadequate  Supervision  was  created  to  account  for  those  times  when 
supervision  proves  inappropriate,  improper,  or  may  not  occur  at  all  (Table  3). 

Planned  Inappropriate  Operations.  Occasionally,  the  operational  tempo  and/or 
schedule  is  planned  such  that  individuals  are  put  at  unacceptable  risk,  crew  rest  is 
jeopardized,  and  ultimately  performance  is  adversely  affected.  Such  operations,  though 
arguably  unavoidable  during  emergency  situations,  are  unacceptable  during  normal 
operations.  Therefore,  we  have  created  a  second  category,  Planned  Inappropriate 
Operations,  to  account  for  these  supervisory  failures  (Table  3).  Included  in  this  category 
are  issues  of  crew  pairing  and  improper  manning.  It's  not  surprising  to  anyone  that  when 
two  individuals  with  marginal  skills  are  paired  together,  problems  can,  and  often  do, 
arise.  With  downsizing  and  the  current  level  of  operational  commitments,  it  is  difficult  to 
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manage  crews.  However,  pairing  two  weak  or  inexperienced  aircrew  together  on  the 
most  difficult  mission  may  not  be  prudent. 

Failure  to  Correct  a  Known  Problem.  The  third  category  of  known  unsafe 
supervision.  Failed  to  Correct  a  Problem,  refers  to  those  instances  when  deficiencies 
among  individuals,  equipment,  training  or  other  related  safety  areas  are  "known"  to  the 
supervisor,  yet  are  allowed  to  continue  uncorrected  (Table  3).  For  example,  the  failure  to 
consistently  correct  or  discipline  inappropriate  behavior  certainly  fosters  an  unsafe 
atmosphere,  but  is  not  considered  a  violation  if  no  specific  rules  or  regulations  were 
broken. 

Supervisory  Violations.  Supervisory  violations,  on  the  other  hand,  are  reserved 
for  those  instances  when  existing  rules  and  regulations  are  willfully  disregarded  by 
supervisors  when  managing  assets  (Table  3).  For  instance,  permitting  an  individual  to 
operate  an  aircraft  without  current  qualifications  or  license  is  a  flagrant  violation  that 
invariably  sets  the  stage  for  the  tragic  sequence  of  events  that  predictably  follow. 

4.  Organizational  Influences 

Fallible  decisions  of  upper-level  management  directly  effect  supervisory  practices, 
as  well  as  the  conditions  and  actions  of  operators.  These  latent  failures  generally  revolve 
around  issues  related  to  resource  management,  organizational  climate,  and  operational 
processes. 

Resource  Management.  This  category  refers  to  the  management,  allocation,  and 
maintenance  of  organizational  resources,  such  as  human,  monetary,  and 
equipment/facilities.  The  term  'human'  refers  to  the  management  of  operators,  staff,  and 
maintenance  personnel.  Issues  that  directly  influence  safety  include  selection  (including 
background  checks),  training,  and  staffing/manning.  Monetary  issues  refer  to  the 
management  of  non-human  resources,  primarily  monetary  resources.  For  example. 
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Table  3.  Selected  examples  of  Unsafe  Supervision  (Note:  this  is  not  a  complete  listing) 

Inadequate  Supervision 

Failed  to  Correct  a  Known  Problem 

Failed  to  Provide  Guidance 

Failed  to  Correct  Document  in  Error 

Failed  to  Provide  Operational  Doctrine 

Failed  to  Identify  an  At-Risk  Aviator 

Failed  to  Provide  Oversight 

Failed  to  Initiate  Corrective  Action 

Failed  to  Provide  Training 

Failed  to  Report  Unsafe  Tendencies 

Failed  to  Track  Qualifications 

Failed  to  Track  Performance 

Supervisorv  Violations 

Authorized  Unnecessary  Hazard 

Planned  Inappropriate  Operations 

Failed  to  Enforce  NATOPS/Regs/SOP 

Failed  to  Provide  Correct  Data 

Failed  to  Enforce  T&R  Manual 

Failed  to  Provide  Adequate  Brief  Time 

Authorized  Unqualified  Crew  for  Right 

Improper  Manning 

Mission  Not  IAW  with  NATOPS/Regs/SOP 

Permitted  Unnecessary  Hazard 

Provided  Inadequate  Opportunity  for  Crew 

Rest 

excessive  cost  cutting,  a  lack  of  funding  for  proper  and  safe  equipment  and  resources  both 
have  adverse  effects  on  operator  performance  and  safety.  Finally,  Equipment/Facility 
refers  to  issues  related  to  equipment  design,  including  the  purchasing  of  unsuitable 
equipment,  inadequate  design  of  work  spaces,  and  failures  to  correct  known  design  flaws. 
Management  should  ensure  that  human  factors  engineering  principles  are  known  and 
utilized  and  that  specifications  for  equipment  and  workspace  design  are  identified  and 
met. 

Organizational  Climate.  Organizational  climate  refers  to  a  broad  class  of 
organizational  variables  that  influence  worker  performance  (Glick,  1985).  It  can  be 
defined  as  the  "situationally  based  consistencies  in  the  organization's  treatment  of 
individuals."  (Jones,  1988).  In  general,  organizational  climate  is  the  prevailing 
atmosphere  or  environment  within  the  organization.  Within  the  present  classification 
system,  climate  is  broken  down  into  three  categories-  structure,  policies,  and  culture.  The 
term  'structure'  refers  to  the  formal  component  of  the  organization  (Mintzberg,  1993). 
The  "form  and  shape"  of  an  organization  are  reflected  in  the  chain-of-command, 
delegation  of  authority 
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Table  4.  Selected  examples  of  Organizational  Influences(Note:  this  is  not  a  complete 

listing) 

Resource/ Acquisition  Management 

Organizational  Process 

Human  Resources 

Operations 

Selection 

Operational  tempo 

Staffing/Manning 

Time  pressure 

Training 

Production  quotas 

Monetary/Budget  Resources 

Incentives 

Excessive  cost  cutting 

Measurement/ Appraisal 

Lack  of  funding 

Schedules 

Equipment/Facility  Resources 

Deficient  planning 

Poor  design 

Procedures 

Purchasing  of  unsuitable  equipment 

Standards 

Clearly  defined  objectives 

Organizational  Climate 

Documentation 

Structure 

Instructions 

Chain-of-command 

Oversight 

Delegation  of  authority 

Risk  Management 

Communication 

Safety  Programs 

Formal  accountability  for  actions 

Policies 

Hiring  and  firing 

Promotion 

Drugs  and  alcohol 

Culture 

Norms  and  rules 

Values  and  beliefs 

Organizational  justice 

Citizen  behavior 

and  responsibility,  communication  channels,  and  formal  accountability  for  actions. 
Organizations  with  maladaptive  structures  (i.e.,  do  not  optimally  match  to  their 
operational  environment  or  are  unwilling  to  change),  will  be  more  prone  to  accidents  and 
"will  ultimately  cease  to  exists."  (Muchinsky,  1997).  Policies  refer  to  a  course  or  method 
of  action  that  guides  present  and  future  decisions.  Policies  may  refer  to  hiring  and  firing, 
promotion,  retention,  raises,  sick  leave,  drugs  and  alcohol,  overtime,  accident 
investigations,  use  of  safety  equipment,  etc.  When  these  policies  are  ill  defined, 
adversarial,  or  conflicting,  safety  may  be  reduced.  Finally,  culture  refers  to  unspoken  or 
unofficial  rules,  values,  attitudes,  beliefs,  and  customs  of  an  organization.    "The  way 
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things  really  get  done  around  here."  Other  issues  related  to  culture  included 
organizational  justice,  psychological  contracts,  organizational  citizenship  behavior,  esprit 
de  corps,  and  union/management  relations.  All  these  issues  affect  attitudes  about  safety 
and  the  value  of  a  safe  working  environment. 

Operational  Process.  This  category  refers  to  the  formal  process  by  which  things 
are  done  in  the  organization.  It  is  subdivided  into  three  broad  categories  -  operations, 
procedures,  and  oversight.  The  term  'operations'  refers  to  the  characteristics  or  conditions 
of  work  that  have  been  established  by  management.  These  characteristics  included 
operational  tempo,  time  pressures,  production  quotas,  incentive  systems,  schedules,  etc. 
When  set  up  inappropriately,  these  working  conditions  can  be  detrimental  to  safety. 
Procedures  are  the  official  or  formal  procedures  as  to  how  the  job  is  to  be  done. 
Examples  include  performance  standards,  objectives,  documentation,  instructions  about 
procedures,  etc.  All  of  these,  if  inadequate,  can  negatively  impact  employee  supervision, 
performance,  and  safety.  Finally,  oversight  refers  to  management's  monitoring  and 
checking  of  resources,  climate,  and  processes  to  ensure  a  safe  and  productive  work 
environment.  Issues  here  relate  to  organizational  self-study,  risk  management,  and  the 
establishment  and  use  of  safety  programs. 
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